moving a summary index

[a212830]

Hi,

One of my customers has a summary index running on a POC that they want to move into my production system. The summary index is on a 4.3 system (windows), and the production system is running on 5.01 (linux). Is it possible to move it? Can I also rename it?

[bmacias84]

Yes, Answer is yes to both questions. Move an index is similar to the process of backup and restoring indexes. Regarding renaming an index I have never don't it but hopefully the links will help you. Dont forget to make sure file system permission are set correctly when migrating.

Here are some docs that will help:

• Restorearchiveddata
• Movinganindex
• MoveIndexes
• how-to-rename-an-index

Hope this helps or gets you started. Dont forget to accept answers and vote on answers that help.

Cheers,

[bmacias84]

I would gzip and rsyn the directors over to the linux server in the appropriate directory. Make sure ur migrated index is set in the indexes.conf.. Set your permissions use cown and chmod. Both servers must gave splunkd stop while doing this. Permissions need to be correct as ntfs perms will not match or carry over.

[a212830]

Thanks. Some good info, but it doesn't cover how to move a windows index to a unix index. Is that possible?