Splunk migration - missing data



We recently migrated our Splunk instance (running v7.1.2) to a new server, also running 7.1.2. Prior to migration, on the original server, we rolled hot buckets to warm, then synced all buckets (warm and cold) to the colddb indexes of the target server.

This worked fine, except we have an 8-hour gap of missing logs. This gap was at the time of our final data sync, not surprisingly. We did another diff and found some buckets that weren't copied over. No big deal, we copied them over... but we're still missing 8 hours of data.

How do we go out getting that 8-hour gap filled in with its events? I'm not sure where else to check, but am wondering if we missed a step somewhere. We still have access to the buckets on the original server if we need to get to them.

Also, we are (were) planning to upgrade the new Splunk server to the latest 7.2 release. Would it be a bad idea to perform this upgrade while troubleshooting missing events? Sounds like it might be.

Does anyone have any suggestions?


Labels (1)

Esteemed Legend

You manually moved the warm buckets to cold?

0 Karma


That is correct. I read somewhere on here that it was okay to do that.
Should we have taken a different approach? Everything appears to be fine except for that small gap in events...

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...