Installation

Migration - will Splunk re-index a directory?

Branden
Builder

Hello. We are migrating to a new Splunk server.

In our current environment, Splunk receives syslog by crawling /logs/////. The /logs directory is an NFS mount.

Our current plan is to migrate our buckets over to our new Splunk server, including the buckets with syslog (which is in the main index). Then we will NFS mount /logs on the new Splunk server. Then I became concerned... assuming the buckets have been migrated over, will Splunk re-index everything in /logs? Or will it just continue from where it left off? Our syslog events go to the main index, so I can't simply not migrate its index.

I would really prefer not to re-index all of /logs if I can avoid it. Will this be the case in our environment?

Thank you!

Labels (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, unless you migrate the fishbucket index, too. Be sure to copy that after you shutdown your old Indexer for the last time.

View solution in original post

woodcock
Esteemed Legend

Yes, unless you migrate the fishbucket index, too. Be sure to copy that after you shutdown your old Indexer for the last time.

Branden
Builder

Thank you!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...