Getting Data In
Highlighted

Can't access data after DB migration

New Member

I backed up all my data, moved it to a larger secondary drive. Uninstalled and re-installed splunk on top of the backed up data on the secondary drive. Now when I search I can not see any data before the backup/install. It's a windows box, and splunk 4.1.3. What can I do?

0 Karma
Highlighted

Re: Can't access data after DB migration

Splunk Employee
Splunk Employee

Where does your backed up data live and do you have the SPLUNK_DB variable set correctly in %SPLUNK_HOME\etc\splunk-launch.conf?

Or do you have your $SPLUNK_HOME\etc\system\local\indexes.conf pointing to the backup location?

Basically what I'm asking is, have you told your new Splunk instance where to find the existing data? An easy solution would be to just copy all of your index buckets into the %SPLUNK_HOME\var\lib\splunk\defaultdb\db directory, assuming it's a brand new instance and you haven't yet made any changes to the files mentioned above.

Highlighted

Re: Can't access data after DB migration

New Member

The %SPLUNK_HOME\etc\splunk-launch.conf is not set. According to the info in the file, it should use the parent directory (D:\splunk) which is where all the files were copied.

I don't have a $SPLUNK_HOME\etc\system\local\indexes.conf
but that directory does exist with other conf files

I did copy the %SPLUNK_HOME\var\lib\splunk\defaultdb\db first, then uninstalled splunk, and re-installed. My inputs.conf is working, but still no access to the old info.

0 Karma
Highlighted

Re: Can't access data after DB migration

New Member

I can see lots of files and directories in %SPLUNK_HOME\var\lib\splunk\defaultdb\db

it looks like the following but with different dates and numbers, obviously.

04/07/2010 09:57 AM

db1219018015121901801524
04/07/2010 09:57 AM 0 db
1219018015121901801524.sentinel
06/05/2010 02:10 PM db1223363806119272320431
06/05/2010 02:10 PM 0 db
1223363806119272320431.sentinel
04/05/2010 09:41 AM db12267846751219014387_2

0 Karma