Splunk Support team and Diag File - Migrate / reproduce a Splunk instance

[inventsekar]

Hi All.. we were wondering why Splunk Support team would require the "diag file" when we open a support ticket?
is that - the splunk support team can "reproduce" my splunk instance on their lab setup to do the analysis?
is it possible? - i mean, from a diag file, can we "Reproduce" the splunk instance?
(untar the diag file, copy the "etc" directory to a newly installed splunk instance and start the splunk.. will it be a reproduction of the old setup?)
thanks,..

[richgalloway]

Diag files do not fully reproduce a Splunk instance. Your data, for example, is not in the diag file. It mainly contains your config files so Splunk support can better diagnose your problem. To see what is included in the file, run splunk diag on the command line then use tar -zlf <diag file>.

[renjith_nair]

Adding to rich's answer, splunk support uses undiag tools and load your data. Predefined dashboards and analysis methods gives them an overview about how your system was performing. So they use it for reproducing your problem rather than recreating the environment.

Please refer to Diag contents for more information about diag contents and the video gives an introduction on how its being used.

[inventsekar]

Thanks Rich..

Thanks Renjith..Your answer answered half of my question.
Yeah, i am not looking to recreate / migrate splunk instance with its diag alone. As you said, we also would like to reproduce the problem(not recreate the whole environment).
Is it possible for us(for splunk customers) or, only splunk support can do that?

[richgalloway]

The diag by itself is useful, but is not always enough. It only contains configs for a single system so any cluster-related problem may require other information to reproduce. Similarly, a problem caused by data may not be reproducible using only the diag.