Deployment Architecture

How to copy index from Linux to Windows?

Carolina
Engager

Hi,

We have a Linux server with diferents indexes but I need to migrate a index a windows server.
We copy all files from the path /opt/splunk/var/lib/splunk/hola/db to the path /opt/splunk/var/lib/splunk/hola/db in windows server. We restart the window server but when I search , the index do not have data.
In the log show me the following message:
08-19-2019 15:26:46.440 -0500 INFO DatabaseDirectoryManager - Getting size on disk: Unable to get size on disk for bucket id=mail~109~C80ED455-8952-4FF9-A9E4-FE78A7D71A68 path="C:\Program Files\Splunk\var\lib\splunk\mail\thaweddb\db_1560957712_1560956580_109" (This is usually harmless as we may be racing with a rename in BucketMover or the S2SFileReceiver thread, which should be obvious in log file; the previous WARN message about this path can safely be ignored.) caller=getBucketManifestValues

Regards.

0 Karma

woodcock
Esteemed Legend

The default for $SPLUNK_DB is not /opt/splunk/var/lib/splunk for Windows. You either need to update $SPLUNK_DB or better yet, create an EXPLICIT path in your indexes.conf entry.

0 Karma

Carolina
Engager

Hi,
I update tha path and file (indexes.conf) but I do not function.
I validate the log and I show me the following messages
08-19-2019 15:26:46.440 -0500 INFO DatabaseDirectoryManager - Getting size on disk: Unable to get size on disk for bucket id=mail~109~C80ED455-8952-4FF9-A9E4-FE78A7D71A68 path="C:\Program Files\Splunk\var\lib\splunk\mail\thaweddb\db_1560957712_1560956580_109" (This is usually harmless as we may be racing with a rename in BucketMover or the S2SFileReceiver thread, which should be obvious in log file; the previous WARN message about this path can safely be ignored.) caller=getBucketManifestValues
Regards.

0 Karma

woodcock
Esteemed Legend

You should NOT be messing with thaweddb! You are NOT thawing, you are merely moving!

0 Karma

Carolina
Engager

what is the process correct for change of index from linux server to windows server? and then work with data in the new server.

0 Karma

woodcock
Esteemed Legend

Just copy it to the correct place as-is. Done.

0 Karma

Carolina
Engager

thank you !
Regards

0 Karma

woodcock
Esteemed Legend

So you got it to work now?

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...