Installation

How to migrate data from existing indexer to newly created indexer without data loss

satyajitjem
New Member

We have one node having all the functionalities like search head, indexer, deployment manager, license manager I.

Now we want to migrate indexer data from existing indexer to newly created indexer without data loss.
Please suggest how to achieve it.

We have two peer node in the proposed setup and one peer node in the current setup.
We are looking for peer to peer index data migration steps.

Thanks in advance

Labels (2)
0 Karma

satyajitjem
New Member

I have single node Splunk instance not cluster
We are looking for migrating .Might be using rsync . Please suggest.

0 Karma

solarboyz1
Builder

If you're not using clustering, rsync is perfect.

We ran incremental rsync's while the indexers were in production.
Shutdown, final rsync, put new indexers into production.

As long as you arent copying buckets from multiple indexers onto a single index (where you would need to adjust the bucket IDs to prevent duplicates), you should be fine.

0 Karma

satyajitjem
New Member

Thanks but this is not my requirement !

I want to migrate a single Index called index=restcall from my stand-alone indexer to another Indexer with same name.

Can you please what steps can be followed.

Regards,
Satyajit

0 Karma

solarboyz1
Builder

Ok, so I would rsync the index from indexerA to indexerB

Shutdown A, disable restcall index (move the data or whatever cleanup you want to do).

Make sure the permission and ownership of the data on B is correct.

Start A and B.

Add B as a peer to your search heads (A should remain a peer)

0 Karma

satyajitjem
New Member

Thanks. Here what I have perfomed :

  1. Stop splunk on Index A & B.
  2. Move the data from A to B.

Index A data path :
Splunk/indexes/restcall/*

Here I have db, colddb, thewdb, summary folders exists and copied to Index B : Path : Splunk/indexes/restcall/

After that o started splunk on both A& B.

Now I could not see Splunk B console, it is not coming up. I have removed the copied foldees from restcall ane restarted splunk and then console came up.

Am I on deviating or skipping any steps here or my approach is wrong here.

Please suggest.

My goal is to see how to migrate a single Index from Indexes A to B.

A& B indexer hosted on separate node and have no connection between them but have connection with deployment manager (Hosted on a separate server) parallely.

Regard,
Satya

0 Karma

solarboyz1
Builder

Ok, so on indexer B, did you configure the index? The index settings will need to be configured on the indexerB. You will need to configure it to point to the locations you just copied over.

If you are still having issue, check your internal logs...look for any issues splunk might be having accessing or reading the new index data.

0 Karma

satyajitjem
New Member

Just to add here, I have started Indedee B first and then checked console, it was down.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...