In Splunk IT Service Intelligence, can you help me transfer data from production to staging?

[ruchijain]

Hi All,

Let me first explain the scenario to you:

i have 4 servers in production and 2 servers in staging. My staging is not up-to date, and we want to move all the data from production to staging so that we can do first the changes in staging and review it there. Then finally, we move it to production.

But there are some searches, dashboards that are specific to environment.

Now the problem is:

1. How do I move such data from production to staging irrespective of the environment?
2. Is there a way so that, once we coordinate both the environment in the future and once we do the changes to the staging, we can move easily to the production for implementation?

I am new to Splunk so I can't find these solutions.

Thanks for your help in advance

[woodcock]

There is actually a document for this:
https://docs.splunk.com/Documentation/Splunk/latest/Installation/MigrateaSplunkinstance

[chrisyounger]

As woodcock implied, there is no native splunk way to do this. If you use rsyncor scp you will also need to deal with the complexity that ITSI stores most of its config in the KVStore.

You can also use version control through a remote (internal) repository to handle moving config around but you will still have the same problem with the KVstore to deal with. There are kvstore backup/restore scripts available (and also a UI option now).

Good luck. Sorry there isn't an easy answer.

[woodcock · Accepted solution]

I always use rsync for this kind of thing, combined with something to do KV Store transfers:

https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/BackupKVstore
OR
https://splunkbase.splunk.com/app/3519/
OR
https://splunkbase.splunk.com/app/3536/