Migrating from Windows to Linux

[lbogle]

Hello Splunkers,
(1st post)
I'm closing down one a Splunk 'test' instance we have on a Windows virtual machine and bringing up a distributed Linux hardware environment w/ 3 Indexers and a single search head. I'm wondering if it would be best to try and migrate/import the data from the VM to one of the Linux Indexers or if it would make more sense to turn the VM into a search peer for the search head? The new Indexers have no data on them as of yet.
Any thoughts?
Thanks,
Lindsay

[lbogle]

Thank you for the input everyone. I appreciate it!

[yannK · Accepted solution]

If you recreate the indexes locations on the new indexers, you can simply copy the old buckets in the correct folders. (and even spread them over several indexers)

example : for the main index the buckets are the subfoldersin $SPLUNK_HOME/var/lib/splunk/defaultdb/db

and if you already have existing buckets in the destination, make sure to avoid bucket id duplicates (you can increment them manually)

example : in db_1345573209_1345573209_10 the bucket_id is 10, in hot_v1_5 the bucket_id is 5

in case of bucket_id collision, here is the behavior : http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled

[pwattssplunk]

Long term having to maintain the single windows instance on VM just to keep alive the amount of data collected during the testing phase doesn't seem to make so much sense. I would recommend migrating the data into the new architecture to simplify your deployment. Hope that helps.

[bmacias84]

I agreee, but how important is the data on your Windows server? I would concider dumping it or moving the indices over. If you have access to the orginal log data, just reindex it so that its distruted.