How do you test a Splunk 6 upgrade? Rsync scheduled search results?


In particular, scheduled searches in dashboards are presenting a problem. I set-up a new search head with Splunk 6 and copied the apps over. The new install has the scheduler disabled because I don't want it messing with the continuously running production searches.

I have not added the new install to the pool for fear of mixing Splunk 5 and Splunk 6 servers' data in the shared storage area.

My idea was to rsync data from the shared storage over to the new server so we can verify dashboards and forms are working as intended. Would this work? Should I sync the entire var sub directory from the shared storage? Or just a particular dir under that tree, like dispatch maybe?

Labels (1)


If you want to rsync the knowledge objects ( i.e. results of the savedsearches), you can rsync the dispatch directory.

$RSYNC /opt/splunk/var/run/splunk/dispatch/* splunk@yourhost::splunk_dispatch

where splunk_dispatch is /opt/splunk/var/run/splunk/dispatch

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...