Deployment Architecture

Urgently move Splunk data from AWS to local today

New Member


This is my situation. I have my main Splunk server on EC2 AWS and I'm trying to move it to a local machine. I cannot lose any data and I only have a couple of days to do it.

I've installed Splunk on my local environment and following this guides [1] and [2], I already copied the data on $splunk_home/etc/apps and $splunk_home/etc/users to the local splunk instalation. So when I open it on the webbrowser, I do see my app, but empty. I know this means that I didn't copy the databases.

But, which DB's or files do I need to copy from Splunk in AWS in order to see my entire data on local with working searches, indexes and all that stuff? I'm not finding any way to do it.

Thanks in advance!


0 Karma


For indexes you'd want $SPLUNK_HOME/var/lib/splunk and all it's sub-directories.

For configs (including the definitions of indexes, apps, includes all user definitions, etc etc..) you'd want $SPLUNK_HOME/etc

Where $SPLUNK_HOME is usually /opt/splunk, but not always. Make sure Splunk is stopped when copying or moving it's files!

At a high-level thats how you'd transfer a Splunk installation, minus the binaries, with a lot of detail glossed over in the interest of brevity.

Hope it helps 🙂


0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...