How to migrate data from existing indexer to newly created indexer without data loss

[satyajitjem]

We have one node having all the functionalities like search head, indexer, deployment manager, license manager I.

Now we want to migrate indexer data from existing indexer to newly created indexer without data loss.
Please suggest how to achieve it.

We have two peer node in the proposed setup and one peer node in the current setup.
We are looking for peer to peer index data migration steps.

Thanks in advance

[somesoni2]

You basically are looking for this:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/MigrateaSplunkinstance#How_to_move_i...
https://firegenanalytics.com/2018/02/moving-an-index-from-one-splunk-server-to-another/

[sandyIscream]

@satyajitjem Please go through the the answer below - https://answers.splunk.com/answers/582405/how-to-migrate-a-clustered-indexer-peer-to-a-new-h.html

https://answers.splunk.com/answers/582405/how-to-migrate-a-clustered-indexer-peer-to-a-new-h.html

[satyajitjem]

I have single node Splunk instance not cluster
We are looking for migrating .Might be using rsync . Please suggest.

[solarboyz1]

If you're not using clustering, rsync is perfect.

We ran incremental rsync's while the indexers were in production.
Shutdown, final rsync, put new indexers into production.

As long as you arent copying buckets from multiple indexers onto a single index (where you would need to adjust the bucket IDs to prevent duplicates), you should be fine.

[satyajitjem]

Thanks but this is not my requirement !

I want to migrate a single Index called index=restcall from my stand-alone indexer to another Indexer with same name.

Can you please what steps can be followed.

Regards,
Satyajit

[solarboyz1]

Ok, so I would rsync the index from indexerA to indexerB

Shutdown A, disable restcall index (move the data or whatever cleanup you want to do).

Make sure the permission and ownership of the data on B is correct.

Start A and B.

Add B as a peer to your search heads (A should remain a peer)

[satyajitjem]

Thanks. Here what I have perfomed :

1. Stop splunk on Index A & B.
2. Move the data from A to B.

Index A data path :
Splunk/indexes/restcall/*

Here I have db, colddb, thewdb, summary folders exists and copied to Index B : Path : Splunk/indexes/restcall/

After that o started splunk on both A& B.

Now I could not see Splunk B console, it is not coming up. I have removed the copied foldees from restcall ane restarted splunk and then console came up.

Am I on deviating or skipping any steps here or my approach is wrong here.

Please suggest.

My goal is to see how to migrate a single Index from Indexes A to B.

A& B indexer hosted on separate node and have no connection between them but have connection with deployment manager (Hosted on a separate server) parallely.

Regard,
Satya

[solarboyz1]

Ok, so on indexer B, did you configure the index? The index settings will need to be configured on the indexerB. You will need to configure it to point to the locations you just copied over.

If you are still having issue, check your internal logs...look for any issues splunk might be having accessing or reading the new index data.

[satyajitjem]

Just to add here, I have started Indedee B first and then checked console, it was down.