How do you test a Splunk 6 upgrade? Rsync scheduled search results?

[twinspop]

In particular, scheduled searches in dashboards are presenting a problem. I set-up a new search head with Splunk 6 and copied the apps over. The new install has the scheduler disabled because I don't want it messing with the continuously running production searches.

I have not added the new install to the pool for fear of mixing Splunk 5 and Splunk 6 servers' data in the shared storage area.

My idea was to rsync data from the shared storage over to the new server so we can verify dashboards and forms are working as intended. Would this work? Should I sync the entire var sub directory from the shared storage? Or just a particular dir under that tree, like dispatch maybe?

[lakshman239]

If you want to rsync the knowledge objects ( i.e. results of the savedsearches), you can rsync the dispatch directory.

$RSYNC /opt/splunk/var/run/splunk/dispatch/* splunk@yourhost::splunk_dispatch

where splunk_dispatch is /opt/splunk/var/run/splunk/dispatch