So I'm planning to follow the Splunk Blog link below:
Already checked the prerequisites.
My questions are:
6.b. Restore the aggregation policy on the ITSI server via the kvstore_to_json.py command line utility. When prompted for the version of the backup, enter 2.6.
I'm just concerned on this part as I have already encountered an issue in upgrading Splunk ITSI before from the earliest version up to 3. Filed a ticket and the ticket was actually not resolved.
How does this restore aggregation policy work? Are there any possible impact or risk on this?
Lloyd - the restore basically auto-creates the agg policy for you from the backup. If I read your question correctly and you already have unresolved KV store issues - I would prioritize fixing those or creating a manual aggregation policy based on the guidance here https://docs.splunk.com/Documentation/ITSI/4.3.1/Configure/HowtocreateAggregationPolicies rather than doing the KV store import.