Getting Data In

Moving splunk from one directory to another in Windows

cboillot
Communicator

We have several servers where the Universal Forwarder has been installed to the wrong drive/directory. During our upgrade window, we are wanting to move these installations to the correct drive/directory.

What is the best way to go about this without losing or duplicating data?

0 Karma
1 Solution

gcusello
Legend

Hi cboillot,
the best way to proceed I think is the following:

  • stop Splunk on Forwarder
  • copy etc directory in a safe directory
  • uninstall Splunk Forwardser from the wrong directory
  • install the same version of Splunk Forwarder into the correct directory
  • stop Splunk
  • copy the saved etc directory on the new etc directory
  • Start Splunk

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi cboillot,
the best way to proceed I think is the following:

  • stop Splunk on Forwarder
  • copy etc directory in a safe directory
  • uninstall Splunk Forwardser from the wrong directory
  • install the same version of Splunk Forwarder into the correct directory
  • stop Splunk
  • copy the saved etc directory on the new etc directory
  • Start Splunk

Bye.
Giuseppe

View solution in original post

0 Karma

cboillot
Communicator

Thank you. Something like this is what I was figuring we would have to do.

I am assuming that it would be best to upgrade the forwarder first, then move it. Would you agree?

0 Karma

gcusello
Legend

Hi cboillot,
it's the same.
the important is that, when you copy the etc directory, you have the same version both in old and new installation.
Bye.
Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!