How to downgrade Splunk 6.4 to 5.0? A config file was overwritten and I didn't do a backup.

[naresha]

I have upgraded Splunk 5.0 to 6.4 and forgot to take a backup where a config file got overwritten, let me know if the below steps will help in restoring...

Un-install Splunk – 6.4 Install
older version 5.0 Try mapping Index’s
that were existing from previous
version Check configuration to see
where applications are discovered

Looking forward for support on helping me in fixing the current situation!!

[ddrillic]

If you elaborate on the issue, it would be great. If you follow the best practices and create your own copies of the config files under the local sub-directories, you should be fine.

More about it at - Update from 6.0 to 6.0.1

[maciep]

This certainly isn't my wheelhouse, but you might want to elaborate a bit on situation. Is this a single server environment? Which conf file was overwritten? How do you plan to get it back by downgrading? What is the actual state of your environment at the moment?

I mean, sure, you can uninstall 6.4 and install 5.0. But without knowing what problems you're actually trying to address from the upgrade, I imagine it will be hard for others to advise you on whether those steps make sense.