Installation

Migration - will Splunk re-index a directory?

Branden
Builder

Hello. We are migrating to a new Splunk server.

In our current environment, Splunk receives syslog by crawling /logs/////. The /logs directory is an NFS mount.

Our current plan is to migrate our buckets over to our new Splunk server, including the buckets with syslog (which is in the main index). Then we will NFS mount /logs on the new Splunk server. Then I became concerned... assuming the buckets have been migrated over, will Splunk re-index everything in /logs? Or will it just continue from where it left off? Our syslog events go to the main index, so I can't simply not migrate its index.

I would really prefer not to re-index all of /logs if I can avoid it. Will this be the case in our environment?

Thank you!

Labels (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, unless you migrate the fishbucket index, too. Be sure to copy that after you shutdown your old Indexer for the last time.

View solution in original post

woodcock
Esteemed Legend

Yes, unless you migrate the fishbucket index, too. Be sure to copy that after you shutdown your old Indexer for the last time.

Branden
Builder

Thank you!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...