Splunk Enterprise

Lookups migration

nejmeddine
Loves-to-Learn

I installed a new splunk pprod platform and I would like to migrate all the prod data to the new platform.

I restored the searchhead prod cluster on the pprod cluster with the backup and restoration of .bundle as indicated in this link:

https://docs.splunk.com/Documentation/Splunk/8.2.12/DistSearch/BackuprestoreSHC

The problem I have is a difference in the number of lookups between the prod and the pprod (pprod contains 1240 lookups and 58 datamodels while the prod contains 1270 lookups and 59 datamodels). Why do I have this difference even though I restored the pprod cluster with the prod .bundle?
What can I do to have the same number on both platforms?

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...