User configuration copy 4.1 ==> 4.3

[echalex]

Hi,
We're about to move our Splunk infrastructure from an environment on 4.1 to 4.3. I'm wondering if I can just copy the directories in etc/users to the new search head, in order to have retain all scheduled searches and alerts. Indeed, I probably need to copy stuff under etc/apps as well.

Any pointers are appreciated.

[Drainy · Accepted solution]

In some version changes Splunk does some migration tasks which updates some config details and changes some bucket structures.
The safest way to do what you want would be to perform an upgrade of your existing infrastructure to the latest version and then to copy the config files over to ensure complete compatibility.
Also make sure you read the known issues as I believe there may be one or two known issues with a 4.1 to 4.3. I believe although I haven't had a look, that the advised route is a 4.1 to 4.2 upgrade and then to 4.3 to avoid any problems.

Best to check the upgrade notes and release notes with both versions to be sure.

[RicoSuave]

You shouldn't run into any issues upgrading from this version. I've done this before and just extracting or installing into the same directory and overwriting will do the trick. You might have to add your license back in.

Reference the 4.2.x version of the installation documentation

http://docs.splunk.com/Documentation/Splunk/4.2.1/Installation/Aboutupgradingto4.2READTHISFIRST

Then reference the current version of the docs. As always, make sure you back up first.

[echalex]

Thanks, but I'm not about to upgrade an existing server. I'm about to switch to a new infrastructure, which is already installed. I just want to copy the old user confs over to the new server.