Getting Data In

Moving splunk from one directory to another in Windows

cboillot
Contributor

We have several servers where the Universal Forwarder has been installed to the wrong drive/directory. During our upgrade window, we are wanting to move these installations to the correct drive/directory.

What is the best way to go about this without losing or duplicating data?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi cboillot,
the best way to proceed I think is the following:

  • stop Splunk on Forwarder
  • copy etc directory in a safe directory
  • uninstall Splunk Forwardser from the wrong directory
  • install the same version of Splunk Forwarder into the correct directory
  • stop Splunk
  • copy the saved etc directory on the new etc directory
  • Start Splunk

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cboillot,
the best way to proceed I think is the following:

  • stop Splunk on Forwarder
  • copy etc directory in a safe directory
  • uninstall Splunk Forwardser from the wrong directory
  • install the same version of Splunk Forwarder into the correct directory
  • stop Splunk
  • copy the saved etc directory on the new etc directory
  • Start Splunk

Bye.
Giuseppe

0 Karma

cboillot
Contributor

Thank you. Something like this is what I was figuring we would have to do.

I am assuming that it would be best to upgrade the forwarder first, then move it. Would you agree?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cboillot,
it's the same.
the important is that, when you copy the etc directory, you have the same version both in old and new installation.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...