Easiest Way to Transfer Summary Index Data?

[mattcg]

What is the easiest way to transfer populated summary indexes from an old Splunk box over to a new instance?

We have weeks worth of computation summarized in our summary indexes, I'd like to be able to simply transfer it (only the summaries, not the raw data) over to our new instance so our histograms continue to function. We currently use 3 different indexes: summary_day, summary_hour, summary_minute.

Thanks!

*Edit: to clarify, the summaries we have took weeks of computation (hence, we don't have the time to run them all from scratch) - not that we simply have weeks of data summarized, otherwise I would just use the fill_summary_index.py script.*

[hulahoop · Accepted solution]

You can simply copy (or move) the directories where the summary indexes live to the new box in the same location. In your Splunk home directory where Splunk is installed look in var/lib/splunk. There should be directories for each of the summary indexes:

summary_daydb
summary_hourdb
summary_minutedb

To be safe, shut down Splunk then move the directories. Make sure your new Splunk instance is also stopped. Then you can start it up after the move completes.

Also, be sure to create the indexes using SplunkWeb or transfer the entries from indexes.conf.