Splunk Enterprise

How to Migrate Splunk from Windows to Linux question?

New Member

I am planning a migration from Windows to Linux.

As I found in Splunk guide, I did following steps:

1. remove instance from distributed search peer.

2. copy whole splunk_home folder to new Linux server.

3. change the paths in configuration file to fit Linux format.

now, I want to install splunk via RPM package to finish migration. but I am not sure which command can keep my configuration, alerts, reports, dashboards from old splunk.

does "rpm -i --replacepkgs --prefix=/splunkdirectory/ splunk_package_name.rpm" can cover my requirement?

if anything I did wrong, please help, thanks in advance.

Labels (2)
Tags (2)
0 Karma

Path Finder

Hey there,


 For alerts, reports, dashboards: these files are stored in respective app folder in etc/apps/xxx


By default, scheduled searches alerts are typically stored in the search app unless while creating you define to another application.


You can tar.gz your existing windows etc/apps folder and untar in your Linux environment.

Tags (1)
0 Karma

New Member

Thanks for your advice, I knew that I can replace folder to migrate configuration and index data, but I just want to find another way to do migration by once install.

Because I found some descriptions in guide as below: (refer to step 3) 

1. Stop Splunk Enterprise on the host from which you want to migrate.
2. Copy the entire contents of the $SPLUNK_HOME directory from the old
host to the new host.
3. Install the appropriate version of Splunk Enterprise for the target platform.
4. Confirm that index configuration files (indexes.conf) contain the correct
location and path specification for any non-default indexes.
5. Start Splunk Enterprise on the new instance.
6. Log into Splunk Enterprise with your existing credentials.
7. After you log in, confirm that your data is intact by searching it. 



0 Karma


Reviving an older post, I'm in this exact same position and am curious; How did you go about switching the file structure over? I've seen some people create scripts. Is that how this is getting done?


0 Karma

Path Finder

it's difficult to answer as there is no one single approach.


best practice is.... lift and shift of config's and apps local. 


0 Karma

Path Finder

Although this seems correct since you are changing the operating system, better try on poc or test instance. 

since some settings in windows os and Linux are different.


Refer to the docs https://docs.splunk.com/Documentation/Splunk/8.0.4/Installation/MigrateaSplunkinstance 

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...