Issue with indexed data while moving to new instance

[vnravikumar]

Hi

I moved the Splunk server(ver.8.0.2 stand alone) into a new instance by copying the entire setup(/opt/splunk). Both are running in Centos7 but the issue is when I started the server in a new instance all the data(till yesterday) got removed from the indexes and the server contains only today's data.  What could be wrong? I moved the entire setup. Need your help here. Or at least how to restore from /opt/splunk/var/lib/.

Thanks,

[saravanan90 · Accepted solution]

If we are migrating standalone instance then above will surely work. Once it is moved, need to update the host in /opt/splunk/etc/system/local/inputs.conf. Check the index files /opt/splunk/var/lib/splunk/$indexname$/db/ are present before & after restarting in new instance.

[vnravikumar]

Thank you.