Splunk migration - missing data

[Branden]

Hello!

We recently migrated our Splunk instance (running v7.1.2) to a new server, also running 7.1.2. Prior to migration, on the original server, we rolled hot buckets to warm, then synced all buckets (warm and cold) to the colddb indexes of the target server.

This worked fine, except we have an 8-hour gap of missing logs. This gap was at the time of our final data sync, not surprisingly. We did another diff and found some buckets that weren't copied over. No big deal, we copied them over... but we're still missing 8 hours of data.

How do we go out getting that 8-hour gap filled in with its events? I'm not sure where else to check, but am wondering if we missed a step somewhere. We still have access to the buckets on the original server if we need to get to them.

Also, we are (were) planning to upgrade the new Splunk server to the latest 7.2 release. Would it be a bad idea to perform this upgrade while troubleshooting missing events? Sounds like it might be.

Does anyone have any suggestions?

Thanks!

[woodcock]

You manually moved the warm buckets to cold?

[Branden]

That is correct. I read somewhere on here that it was okay to do that.
Should we have taken a different approach? Everything appears to be fine except for that small gap in events...