Archive

How to restore to 5.x from 6.0

RVDowning
Contributor

I copied the /opt/splunk directory before upgrading to 6.0. Now I find that none of the forwarders work. They are not forwarding the transactions to 6.0. We don't have the time to send the 6.0 forwarder to the laptops to see if they will work, so we need to restore. What is the procedure? Just delete the /opt/splunk 6.0 structure and copy back the old 5.x structure to /opt/splunk?

Tags (1)

ShaneNewman
Motivator

That is what I did. I did have to delete a few of the index files to keep get the indexes to come back up afterwards.

0 Karma

ShaneNewman
Motivator
0 Karma

ShaneNewman
Motivator

First you will want to roll everything from Hot to warm. Then delete the hot buckets. When you restart Splunk after the rollback, it will create new hot buckets.

This is the command for it, just replace the index name with the name of your index(es) and your username/pw.

splunk _internal call /data/indexes//roll-hot-buckets –auth :

0 Karma

RVDowning
Contributor

From which bucket did you wipe out files? The hot bucket? How did you recreate those indexes?

0 Karma