Moving splunk from one directory to another in Windows

[cboillot]

We have several servers where the Universal Forwarder has been installed to the wrong drive/directory. During our upgrade window, we are wanting to move these installations to the correct drive/directory.

What is the best way to go about this without losing or duplicating data?

[gcusello · Accepted solution]

Hi cboillot,
the best way to proceed I think is the following:

• stop Splunk on Forwarder
• copy etc directory in a safe directory
• uninstall Splunk Forwardser from the wrong directory
• install the same version of Splunk Forwarder into the correct directory
• stop Splunk
• copy the saved etc directory on the new etc directory
• Start Splunk

Bye.
Giuseppe

[cboillot]

Thank you. Something like this is what I was figuring we would have to do.

I am assuming that it would be best to upgrade the forwarder first, then move it. Would you agree?

[gcusello]

Hi cboillot,
it's the same.
the important is that, when you copy the etc directory, you have the same version both in old and new installation.
Bye.
Giuseppe