Migrating Indexed data to different splunk instance

New Member


Is it possible to migrate indexed data from one Splunk instance to another splunk instance.

I have a few indexes which have been holding data for a few years and now I need to move this to a different spunk instance. New Splunk instance completely new environment without any of the old indexes created in it


Labels (1)
0 Karma

Esteemed Legend

It is easy if the new system has no data; just rsync the entire directory structures for the indexed data over.

If the old system has data for the same index values, you need to understand the meaning of the <indexname>.dat file and you may need to modify bucket IDs. A bucket looks like this db_1571769855_1571338901_193 The _193 is the bucket ID. This is arbitrary (except for the value in <indexname>.dat) and must be unique within any index (across both warm and cold directories). If you have two ..._123 buckets, one of them will have to be renamed. The trick is that the value in <indexname>.dat is the next available incrementalbucket ID` value for that index. You need to make sure that as you are reconciling conflicts and consuming higher numbers, that you also bump up that number.

0 Karma


Hi @Gowtham0809,
yes it's possible to migrate data from a Splunk instance to another.
There are two situations:

  1. If in the same index of the new instance you haven't data;
  2. If in the same index of the new instance you already have data.

In the first case, you can follow the instructions at and move indexes from the old instance to the new one.

In the second case, the easier approach is to export data in row format (e.g. using a search index=my_index and export data)
and reindexing them in the new instance.
Put attention when you export data that you are exporting all the data ( ).

Obviously you'll exceed your license for a day, but usually it isn't a problem, anyway put attention if you have other exceedings in the last 30 days to avoid license violations.


0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>