Splunk migration - missing data



We recently migrated our Splunk instance (running v7.1.2) to a new server, also running 7.1.2. Prior to migration, on the original server, we rolled hot buckets to warm, then synced all buckets (warm and cold) to the colddb indexes of the target server.

This worked fine, except we have an 8-hour gap of missing logs. This gap was at the time of our final data sync, not surprisingly. We did another diff and found some buckets that weren't copied over. No big deal, we copied them over... but we're still missing 8 hours of data.

How do we go out getting that 8-hour gap filled in with its events? I'm not sure where else to check, but am wondering if we missed a step somewhere. We still have access to the buckets on the original server if we need to get to them.

Also, we are (were) planning to upgrade the new Splunk server to the latest 7.2 release. Would it be a bad idea to perform this upgrade while troubleshooting missing events? Sounds like it might be.

Does anyone have any suggestions?


Labels (1)

Esteemed Legend

You manually moved the warm buckets to cold?

0 Karma


That is correct. I read somewhere on here that it was okay to do that.
Should we have taken a different approach? Everything appears to be fine except for that small gap in events...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...