Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: How to copy index from Linux to Windows?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to copy index from Linux to Windows?
Hi,
We have a Linux server with diferents indexes but I need to migrate a index a windows server.
We copy all files from the path /opt/splunk/var/lib/splunk/hola/db to the path /opt/splunk/var/lib/splunk/hola/db in windows server. We restart the window server but when I search , the index do not have data.
In the log show me the following message:
08-19-2019 15:26:46.440 -0500 INFO DatabaseDirectoryManager - Getting size on disk: Unable to get size on disk for bucket id=mail~109~C80ED455-8952-4FF9-A9E4-FE78A7D71A68 path="C:\Program Files\Splunk\var\lib\splunk\mail\thaweddb\db_1560957712_1560956580_109" (This is usually harmless as we may be racing with a rename in BucketMover or the S2SFileReceiver thread, which should be obvious in log file; the previous WARN message about this path can safely be ignored.) caller=getBucketManifestValues
Regards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The default for $SPLUNK_DB is not /opt/splunk/var/lib/splunk for Windows. You either need to update $SPLUNK_DB or better yet, create an EXPLICIT path in your indexes.conf entry.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I update tha path and file (indexes.conf) but I do not function.
I validate the log and I show me the following messages
08-19-2019 15:26:46.440 -0500 INFO DatabaseDirectoryManager - Getting size on disk: Unable to get size on disk for bucket id=mail~109~C80ED455-8952-4FF9-A9E4-FE78A7D71A68 path="C:\Program Files\Splunk\var\lib\splunk\mail\thaweddb\db_1560957712_1560956580_109" (This is usually harmless as we may be racing with a rename in BucketMover or the S2SFileReceiver thread, which should be obvious in log file; the previous WARN message about this path can safely be ignored.) caller=getBucketManifestValues
Regards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should NOT be messing with thaweddb! You are NOT thawing, you are merely moving!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what is the process correct for change of index from linux server to windows server? and then work with data in the new server.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just copy it to the correct place as-is. Done.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you !
Regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So you got it to work now?
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
