We need to close a splunk installation. How do we prepare and export all the logs it has collected to use in a different Splunk instance?

[pwarricker]

We have a contract coming to its end and need to close Splunk for them, but we still need all the data accessible afterwards so that it can be loaded into a different Splunk instance if required.

[aholzer]

We had to do this with an old standalone instance when we purchased hardware for a clustered environment. Here's what you need to do:

1. Check # of events in the index on a clustered indexer. Example: search index=juniper returns 619 events
2. Check # of events in the index on a standalone (old) indexer. Example: search index=188961 returns 2798 events
3. Copy / zip buckets from 188961 index on standalone indexer to some temporary repository on clustered indexer
4. Put cluster master in maintenance mode
5. Stop Splunk on clustered indexer
6. Copy / unzip buckets from 188961 index into the colddb directory of the juniper index on the clustered indexer
7. Start Splunk on clustered indexer
8. Take cluster master out of maintenance mode
9. Confirm search returns sum of both results. Example: search index=juniper on cluster master (returns 3417 events)

Hope this helps