Splunk Search

How to merge two different indexes on different servers?

paul_hignutt
Engager

I have a customer that we did an extended PoC for on an old small server (3 months+). That customer purchased Splunk> and because of timing we just migrated the license to the new install on a different new server. That's been running for a few weeks now, and they would like to merge the data from the old PoC install. The old PoC install was on Linux (Ubuntu) and the new permanent install is on Windows. The old box seems to have about 280GB of files. I'd like to migrate the saved searches too.

How do I merge the two, and not loose anything? I'm a Splunk> n00b.

Tags (1)

MarioM
Motivator

apps are in splunk/etc/apps or splunk\etc\apps

indexes are splunk/var/lib/splunk or splunk\var\lib\splunk

for the savedsearches you will need to move the savedsearches.conf (and any other .conf files) either to a new app or if the existing same app on the new box has nothing in local folder then you can move it there.

for the indexes data it's more tricky as there might be bucket conflict then:

-easiest is to move the content from your old box index's folder to your new box new or non-existing index folder and update indexes.conf as per doc

-hard-way? here there is howto at the bottom: http://wiki.splunk.com/Community:MoveIndexes

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...