Archive

Migrating from Windows to Linux

Contributor

Hello Splunkers,
(1st post)
I'm closing down one a Splunk 'test' instance we have on a Windows virtual machine and bringing up a distributed Linux hardware environment w/ 3 Indexers and a single search head. I'm wondering if it would be best to try and migrate/import the data from the VM to one of the Linux Indexers or if it would make more sense to turn the VM into a search peer for the search head? The new Indexers have no data on them as of yet.
Any thoughts?
Thanks,
Lindsay

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

If you recreate the indexes locations on the new indexers, you can simply copy the old buckets in the correct folders. (and even spread them over several indexers)

example : for the main index the buckets are the subfoldersin $SPLUNK_HOME/var/lib/splunk/defaultdb/db

and if you already have existing buckets in the destination, make sure to avoid bucket id duplicates (you can increment them manually)

example : in db_1345573209_1345573209_10 the bucket_id is 10, in hot_v1_5 the bucket_id is 5

in case of bucket_id collision, here is the behavior : http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled

View solution in original post

Contributor

Thank you for the input everyone. I appreciate it!

0 Karma

Splunk Employee
Splunk Employee

If you recreate the indexes locations on the new indexers, you can simply copy the old buckets in the correct folders. (and even spread them over several indexers)

example : for the main index the buckets are the subfoldersin $SPLUNK_HOME/var/lib/splunk/defaultdb/db

and if you already have existing buckets in the destination, make sure to avoid bucket id duplicates (you can increment them manually)

example : in db_1345573209_1345573209_10 the bucket_id is 10, in hot_v1_5 the bucket_id is 5

in case of bucket_id collision, here is the behavior : http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled

View solution in original post

Splunk Employee
Splunk Employee

Long term having to maintain the single windows instance on VM just to keep alive the amount of data collected during the testing phase doesn't seem to make so much sense. I would recommend migrating the data into the new architecture to simplify your deployment. Hope that helps.

Champion

I agreee, but how important is the data on your Windows server? I would concider dumping it or moving the indices over. If you have access to the orginal log data, just reindex it so that its distruted.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!