How to merge two different indexes on different servers?

[paul_hignutt]

I have a customer that we did an extended PoC for on an old small server (3 months+). That customer purchased Splunk> and because of timing we just migrated the license to the new install on a different new server. That's been running for a few weeks now, and they would like to merge the data from the old PoC install. The old PoC install was on Linux (Ubuntu) and the new permanent install is on Windows. The old box seems to have about 280GB of files. I'd like to migrate the saved searches too.

How do I merge the two, and not loose anything? I'm a Splunk> n00b.

[MarioM]

apps are in splunk/etc/apps or splunk\etc\apps

indexes are splunk/var/lib/splunk or splunk\var\lib\splunk

for the savedsearches you will need to move the savedsearches.conf (and any other .conf files) either to a new app or if the existing same app on the new box has nothing in local folder then you can move it there.

for the indexes data it's more tricky as there might be bucket conflict then:

-easiest is to move the content from your old box index's folder to your new box new or non-existing index folder and update indexes.conf as per doc

-hard-way? here there is howto at the bottom: http://wiki.splunk.com/Community:MoveIndexes