Getting Data In

What is the best way to migrate old data from a single Splunk server to a new cluster?


Is there any way to point my old Splunk server at the new cluster and have it forward all of my previously indexed events to the cluster so that they are evenly distributed across the nodes and can take advantage of replication?

Splunk support says no. They say I can sync my old indexes to a single node of the cluster, but they won't take advantage of replication. I can have my search head run distributed searches on the old Splunk server, but then my old data won't get to take advantage of the new hardware in the cluster.

Has anyone in the community figured out a smart way to do this? Is there no way to tell an old indexer to forward all of its indexes to a new cluster?



Tags (2)
0 Karma

New Member


I have similar trouble. I have my old data in an Indexer and I want to make this indexer as one the 2 peer nodes in the cluster. Once I introduce a master node to this cluster of old and new indexer, will the old data on the old indexer be replicated to the new one and get me search capabilities on both nodes for the old data?


0 Karma

Splunk Employee
Splunk Employee

I'm going to have to go with Support on this one. If your retention time isn't terribly long, I'd just set the old server as a search peer of the new cluster. Once the indexes expire, decommission the old server. Otherwise, I'd go with their first suggestion and copy the indexes over.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...