Installation

Migration - will Splunk re-index a directory?

Branden
Builder

Hello. We are migrating to a new Splunk server.

In our current environment, Splunk receives syslog by crawling /logs/////. The /logs directory is an NFS mount.

Our current plan is to migrate our buckets over to our new Splunk server, including the buckets with syslog (which is in the main index). Then we will NFS mount /logs on the new Splunk server. Then I became concerned... assuming the buckets have been migrated over, will Splunk re-index everything in /logs? Or will it just continue from where it left off? Our syslog events go to the main index, so I can't simply not migrate its index.

I would really prefer not to re-index all of /logs if I can avoid it. Will this be the case in our environment?

Thank you!

Labels (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, unless you migrate the fishbucket index, too. Be sure to copy that after you shutdown your old Indexer for the last time.

View solution in original post

woodcock
Esteemed Legend

Yes, unless you migrate the fishbucket index, too. Be sure to copy that after you shutdown your old Indexer for the last time.

Branden
Builder

Thank you!

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...