In the past, I knew indexed data was kept after upgrading a Splunk server from this site.
However, I cannot find that information now.
If you know the Splunk documentation link/URL where this is described, please let me know.
Assuming your Splunk instance is a single standalone server and you didn't move the default location, then yes your indexed data will be under
$SPLUNK_HOME/var/lib/splunk/<your_index>
after a Splunk upgrade.
Under each index will be db
, colddb
, datamodel_summary
, etc. (and describing those is beyond the scope of this question, but you can learn more about it here: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/HowSplunkstoresindexes ).
http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/HowSplunkstoresindexes
It is written on above site about indexed data after upgrade?
What I want to know is that to guard old indexed data after splunk server upgrade.
For guarantee, I want to know official answer on Splunk site.
General info: http://docs.splunk.com/Documentation/Splunk/6.2.2/Installation/HowtoupgradeSplunk
Specific info: If you really want to know then open up the installer file (tgz
, rpm
, etc.) and see exactly which files Splunk will override. You'll see that it doesn't overwrite or delete any of your indexed data at $SPLUNK_HOME/var/lib/splunk/
.