Splunk Search

How to merge two different indexes on different servers?

paul_hignutt
Engager

I have a customer that we did an extended PoC for on an old small server (3 months+). That customer purchased Splunk> and because of timing we just migrated the license to the new install on a different new server. That's been running for a few weeks now, and they would like to merge the data from the old PoC install. The old PoC install was on Linux (Ubuntu) and the new permanent install is on Windows. The old box seems to have about 280GB of files. I'd like to migrate the saved searches too.

How do I merge the two, and not loose anything? I'm a Splunk> n00b.

Tags (1)

MarioM
Motivator

apps are in splunk/etc/apps or splunk\etc\apps

indexes are splunk/var/lib/splunk or splunk\var\lib\splunk

for the savedsearches you will need to move the savedsearches.conf (and any other .conf files) either to a new app or if the existing same app on the new box has nothing in local folder then you can move it there.

for the indexes data it's more tricky as there might be bucket conflict then:

-easiest is to move the content from your old box index's folder to your new box new or non-existing index folder and update indexes.conf as per doc

-hard-way? here there is howto at the bottom: http://wiki.splunk.com/Community:MoveIndexes

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...