I have a windows server and it's OS got crashed but i have the splunk database in the another drive which is fine now the steps I have performed are in the new splunk installation are:
1. Copied the configurations of the previous splunk application from the backup i have in to the new application.
2. Changed the database location and created the database structure in another drive apart from C: drive.
3. Now from the earlier database i copied the indexed data in to the new data base where i have overwritten the already present indexes which are created as per the indexer configuration.
4. Now when i restart the splunk i am getting a "DIRTY_DATABASE File (.dirty_database)" file generated.
5. But i can see the data in the indexes when i ran a search
So, the question is whether the procedure i followed is correct or is there any other way to do this
Thanks,
Your well wisher
Hi
here is link how to move index database to the nee location https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Moveanindex
When I need to move db to the new node I have followed this https://community.splunk.com/t5/Installation/How-to-migrate-indexes-to-new-indexer-instance/m-p/5280... That was for linux node, but you can do same procedure with windows with small changes to used commands.
r. Ismo