Archive
Highlighted

Migrating from Windows to Linux

Contributor

Hello Splunkers,
(1st post)
I'm closing down one a Splunk 'test' instance we have on a Windows virtual machine and bringing up a distributed Linux hardware environment w/ 3 Indexers and a single search head. I'm wondering if it would be best to try and migrate/import the data from the VM to one of the Linux Indexers or if it would make more sense to turn the VM into a search peer for the search head? The new Indexers have no data on them as of yet.
Any thoughts?
Thanks,
Lindsay

Tags (1)
0 Karma
Highlighted

Re: Migrating from Windows to Linux

Splunk Employee
Splunk Employee

Long term having to maintain the single windows instance on VM just to keep alive the amount of data collected during the testing phase doesn't seem to make so much sense. I would recommend migrating the data into the new architecture to simplify your deployment. Hope that helps.

Highlighted

Re: Migrating from Windows to Linux

Champion

I agreee, but how important is the data on your Windows server? I would concider dumping it or moving the indices over. If you have access to the orginal log data, just reindex it so that its distruted.

0 Karma
Highlighted

Re: Migrating from Windows to Linux

Splunk Employee
Splunk Employee

If you recreate the indexes locations on the new indexers, you can simply copy the old buckets in the correct folders. (and even spread them over several indexers)

example : for the main index the buckets are the subfoldersin $SPLUNK_HOME/var/lib/splunk/defaultdb/db

and if you already have existing buckets in the destination, make sure to avoid bucket id duplicates (you can increment them manually)

example : in db1345573209134557320910 the bucketid is 10, in hotv15 the bucket_id is 5

in case of bucket_id collision, here is the behavior : http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled

View solution in original post

Highlighted

Re: Migrating from Windows to Linux

Contributor

Thank you for the input everyone. I appreciate it!

0 Karma