Migrating a stand-alone linux server to a shared Linux server


We've currently got a stand-alone 64-bit linux box handling inputs from a collection of Splunk forwarders, all on 4.2.5. $SPLUNK_HOME is still set to it's default and all of the data is flowing into the original, default index. We've got about 13 millions events, a lot of saved searches and dashboards.

We're now looking at how to migrate our system over to an existing 64-bit Linux Splunk setup that's running on 4.2.2. I've been reading the docs and Splunkbase about migration but am still not clear on how this would actually work. I can zip/tar the original data, but how will that work on the new server? I guess what I'm after is that we've got a home directory on the new server with all of our old data, field extractions, etc. that doesn't interfere with the rest of the server. Is that possible, given that the data is currently in the standard home default?

The server admin is happy to set up a specific index for us on the server farm, but I'm hoping to migrate our past events without export-to-CSV-and-reimport and to keep our existing searches, dashboards, etc.

Thanks for any guidance or links.

Tags (1)
0 Karma

  1. Make a copy of the $SPLUNK_HOME$/var/ and $SPLUNK_HOME$/etc/ directories.

This will include your indexes (by default, your main Splunk index is located in $SPLUNK_HOME$/var/lib/splunk/) and any configuration files you've changed in $SPLUNK_HOME$/etc/system/local, $SPLUNK_HOME$/etc/users and $SPLUNK_HOME$/etc/apps.

  1. Stop the Splunk services (splunkd and splunkweb) again.

  2. Copy the following files and directories from the copy of $SPLUNK_HOME$/etc/ that you set aside (indexes and configuration files) back into the same locations in the new installation.






    $SPLUNK_HOME$/etc/deployment-apps (if the Splunk instance is a deployment server)

    $SPLUNK_HOME$/etc/log-local.cfg (if a local version was manually created)






  3. In your new installation of Splunk, rename the $SPLUNK_HOME$/var/ directory to something else (like $SPLUNK_HOME$/var.delete/) and then copy over the $SPLUNK_HOME$/var/ directory you saved.

You can later delete the var.delete directory.

  1. Restart Splunk, and check your configurations.

  2. Remove your old installation

0 Karma


I would not migrate configs to a lower splunk version as there might be change which will not work...

Then first upgrade your second splunk instance to same version.

All configs are in splunk/etc , all indexed data by default are in splunk/var/lib/splunk

Migrating a Splunk Install

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...