Splunk Enterprise

Splunk Database copy to new_instance

New Member

I have a windows server and it's OS got crashed but i have the splunk database  in the another drive which is fine now the steps I have performed are in the new splunk installation are:

1. Copied the configurations of the previous splunk application from the backup i have in to the new application.

2. Changed the database location and created the database structure in another drive apart from C: drive.

3. Now from the earlier database i copied the indexed data in to the new data base where i have overwritten the already present indexes which are created as per the indexer configuration.

4. Now when i restart the splunk i am getting a "DIRTY_DATABASE File (.dirty_database)" file generated.

5. But i can see the data in the indexes when i ran a search

So, the question is whether the procedure i followed is correct or is there any other way to do this


Your well wisher

Labels (2)
0 Karma



here is link how to move index database to the nee location https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Moveanindex

When I need to move db to the new node I have followed this https://community.splunk.com/t5/Installation/How-to-migrate-indexes-to-new-indexer-instance/m-p/5280... That was for linux node, but you can do same procedure with windows with small changes to used commands.

  1. Copy data + configurations to correct place
    1. As you are moving SPLUNK_DB to a new directory,  you must update correct parameters (see docs link)
  2. Install fresh splunk (same version than in old node)
  3. Start splunk
  4. Check that all is ok
  5. Update to the latest/needed version

r. Ismo

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...