Hello
Is it possible to migrate indexed data from one Splunk instance to another splunk instance.
I have a few indexes which have been holding data for a few years and now I need to move this to a different spunk instance. New Splunk instance completely new environment without any of the old indexes created in it
Thanks,
It is easy if the new system has no data; just rsync
the entire directory structures for the indexed data over.
If the old system has data for the same index values, you need to understand the meaning of the <indexname>.dat
file and you may need to modify bucket IDs
. A bucket looks like this db_1571769855_1571338901_193
The _193
is the bucket ID
. This is arbitrary (except for the value in <indexname>.dat
) and must be unique within any index (across both warm and cold directories). If you have two ..._123
buckets, one of them will have to be renamed. The trick is that the value in <indexname>.dat is the next available incremental
bucket ID` value for that index. You need to make sure that as you are reconciling conflicts and consuming higher numbers, that you also bump up that number.
Hi @Gowtham0809,
yes it's possible to migrate data from a Splunk instance to another.
There are two situations:
In the first case, you can follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Moveanindex and move indexes from the old instance to the new one.
In the second case, the easier approach is to export data in row format (e.g. using a search index=my_index
and export data)
and reindexing them in the new instance.
Put attention when you export data that you are exporting all the data ( https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/ExportdatausingSplunkWeb ).
Obviously you'll exceed your license for a day, but usually it isn't a problem, anyway put attention if you have other exceedings in the last 30 days to avoid license violations.
Ciao.
Giuseppe