Deployment Architecture
Highlighted

How to re-enable an index that was disabled after migrating Splunk indexer from Windows to Linux?

SplunkTrust
SplunkTrust

I'm in the process of moving my standalone indexer from Windows to Linux. I'm in the last part of my journey of moving the data over to the new index. After moving my Windows DB file full of data to the new Linux DB file (overwriting) and restarting Splunk, I noticed my index is disabled. I attempted to enable the index but it does not work..

I'm suspecting the issue is a bucket_id collision, but not 100% sure.. how can I fix this so the index is enabled?

0 Karma
Highlighted

Re: How to re-enable an index that was disabled after migrating Splunk indexer from Windows to Linux?

SplunkTrust
SplunkTrust

I just found the issue! I had duplicate bucket names in %SPLUNK_HOME/var/lib/splunk/.../db

To solve the issue I just appended a number to the bucket and restarted Splunk

View solution in original post

Highlighted

Re: How to re-enable an index that was disabled after migrating Splunk indexer from Windows to Linux?

Path Finder

Hi, Skoelpin

I have had the same issue. Because of duplicated bucket names in Splunk, it has automatically disabled the majority of my indexes. I have identified the buckets with duplicated names and I have stop Splunk, renamed them to other non duplicated names, and start Splunk, but the data of my indexes seems to be deleted (search does not return nothing). In the directory of the buckets (db) there is data, and I don't know why is not returning data.

Had you done any additional thing to make work the index after change the name of the bucket?

Thanks!!!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.