Deployment Architecture

Is it possible to migrate data from 3.3.4 Sparc to 4.1.4 Linux?

mctester
Communicator

I would like to migrate my indexed data from Splunk 3.3.4 on a Sparc Solaris 10 platform to Splunk 4.1.4 on a Linux (Redhat) kernel 2.6.18-186.el5 x86-64 guest on VmWare ESX. It sounds like it is not possible to migrate the index directly, but can I do something with the compressed raw data piece of the database?

0 Karma

Mick
Splunk Employee
Splunk Employee

You're correct, a direct migration of data between the 2 platforms is not possible.

The only option you have here if the source data is no longer available, is a convoluted process of exporting your data to csv and importing it again into your new instance. There's a Community article here that talks about how to do this when you want to update the actual indexed data, but the same principle can be applied to your use case.

Please note that if you need help in migrating your data, that would fall under the Professional Services banner, as it is rarely a straightforward task and there are always local environment factors to consider.

If all you want is that your data remains available for searching when you spin up your new Linux instance, then it may be easier for you to leave your old Sparc instance in place and configured distributed searching so that it will be searchable from the new instance.

jrodman
Splunk Employee
Splunk Employee

Note that exporttool and importtol are both fairly computationally expensive. Have a lot (4+GB) of ram and let it run a long time. It should work though.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...