Splunk Enterprise

Migrating a folder monitor to a new Splunk server

salles
Loves-to-Learn Lots

Hi,

I tried to search for this online and I am probably not typing my search correctly :-), and am hoping one of you Splunk experts could possibly help me or point me in the right direction.

I have a full Splunk heavy forwarder that is monitoring some network folders (and sending them to some indexes using the outputs.conf configuration).

This server is going to be retired, and I am moving this to a new Splunk server installation. 

My question is, where does Splunk store the information about the last file it has read ? 

I am looking to recreate the Directory Monitor input ont he new server, however, I am assuming that on the new server, it would start reading the folder from scratch again.  I am hoping to stop the old serve's input and start the new server but have the new server read from where the old server left off.

Any help would be appreciated.  Thanks so much!  Oh also this is on Microsoft Windows.

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...