Monitoring Splunk

Splunk Support team and Diag File - Migrate / reproduce a Splunk instance

inventsekar
Super Champion

Hi All.. we were wondering why Splunk Support team would require the "diag file" when we open a support ticket?
is that - the splunk support team can "reproduce" my splunk instance on their lab setup to do the analysis?
is it possible? - i mean, from a diag file, can we "Reproduce" the splunk instance?
(untar the diag file, copy the "etc" directory to a newly installed splunk instance and start the splunk.. will it be a reproduction of the old setup?)
thanks,..

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Diag files do not fully reproduce a Splunk instance. Your data, for example, is not in the diag file. It mainly contains your config files so Splunk support can better diagnose your problem. To see what is included in the file, run splunk diag on the command line then use tar -zlf <diag file>.

---
If this reply helps you, an upvote would be appreciated.

renjith_nair
SplunkTrust
SplunkTrust

Adding to rich's answer, splunk support uses undiag tools and load your data. Predefined dashboards and analysis methods gives them an overview about how your system was performing. So they use it for reproducing your problem rather than recreating the environment.

Please refer to Diag contents for more information about diag contents and the video gives an introduction on how its being used.

inventsekar
Super Champion

Thanks Rich..

Thanks Renjith..Your answer answered half of my question.
Yeah, i am not looking to recreate / migrate splunk instance with its diag alone. As you said, we also would like to reproduce the problem(not recreate the whole environment).
Is it possible for us(for splunk customers) or, only splunk support can do that?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The diag by itself is useful, but is not always enough. It only contains configs for a single system so any cluster-related problem may require other information to reproduce. Similarly, a problem caused by data may not be reproducible using only the diag.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!