Splunk Search

Porting from one machine to another

terryloar
Path Finder

I have a need to capture all of the Splunk work that I've done on one machine and move it to another machine. It's dev to dev, not an official deployment.

I tried copying the C:\Program Files\Splunk\etc\apps\search\local directory to the new machine, but the Dashboard & Views dropdown was the old one.

I also tried to copy $SPLUNK_HOME, but it did not get all of the files.

Any ideas on how to do this would be appreciated. The simpler, the better.

Thanks

Thanks.

Tags (1)
0 Karma

lguinn2
Legend

There is a wiki article about this: Migrating a Splunk Install

But if the underlying operating system is the same, you can just copy the installation.
For example, in Linux, assuming that $SPLUNK_HOME is /opt/splunk' and you are running as the usersplunkIT`

# on the current machine
su splunkIT
cd /opt/splunk/bin
./splunk stop
cd /opt
tar -czf splunk.tgz splunk

# on the new machine (assumes that user splunkIT exists there as well)
# copy the splunk.tgz to /opt  using any method, and
# make sure that splunk.tgz is owned by splunkIT

su  splunkIT
cd /opt
tar -xzf splunk.tgz
cd splunk/bin
./splunk start

Note that this assumes that the Splunk indexes are also stored beneath the /opt/splunk directory. If they are not, you will have go through similar steps to copy them as well.

0 Karma

terryloar
Path Finder

I closed the browser and restarted splunk.exe restart from the command line. The menu items now appear.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...