Splunk Search

How to merge two different indexes on different servers?

paul_hignutt
Engager

I have a customer that we did an extended PoC for on an old small server (3 months+). That customer purchased Splunk> and because of timing we just migrated the license to the new install on a different new server. That's been running for a few weeks now, and they would like to merge the data from the old PoC install. The old PoC install was on Linux (Ubuntu) and the new permanent install is on Windows. The old box seems to have about 280GB of files. I'd like to migrate the saved searches too.

How do I merge the two, and not loose anything? I'm a Splunk> n00b.

Tags (1)

MarioM
Motivator

apps are in splunk/etc/apps or splunk\etc\apps

indexes are splunk/var/lib/splunk or splunk\var\lib\splunk

for the savedsearches you will need to move the savedsearches.conf (and any other .conf files) either to a new app or if the existing same app on the new box has nothing in local folder then you can move it there.

for the indexes data it's more tricky as there might be bucket conflict then:

-easiest is to move the content from your old box index's folder to your new box new or non-existing index folder and update indexes.conf as per doc

-hard-way? here there is howto at the bottom: http://wiki.splunk.com/Community:MoveIndexes

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...