How do I move VER.9.0.2 data to Ver.7.3.3? I cover it up?

[minpd0309]

Can I overwrite the data I accumulated in Ver.9.0.2 Enterprise to Ver.7.3.3 Enterprise?

[PickleRick]

Adding to @scelikok 's answer - you can't (or at least not without some heavy splunk internal developer level magic) convert index file from a higher tsidx level to a lower one.

7.3.x does support tsidx levels of 1, 2 and 3 whereas 9.0.x supports 1, 2, 3 and 4. If your 9.0.2 indexes are configured with the default level of 3, you _might_ be able to move your data.

Having said that - why would you want to use so obsolete version which has no support and lacks many features?

[scelikok]

Hi @minpd0309,

It depends on indexes.conf configurations. The most critical parameters are below;

indexes.conf

tsidxWritingLevel = [1|2|3]
7.3.3 default is 1
9.0.2 default is 3

journalCompression = gzip|lz4|zstd
7.3.3 default is gzip
9.0.2 default is zstd

 If you are using 9.0.2 defaults on your 7.3.3 you can try. But if not unfortunately you cannot copy.

If parameters are the same,  it is better to try on a seperate test server first.

[minpd0309]

please answer me  T . T TTTTTTTTTTTTTTTTTTT