Yup. As @richgalloway said, if by configuration you mean copying over all the stuff in $SPLUNK_HOME, that means simply copying your whole installation in whatever version it is right now. Since apps ...
See more...
Yup. As @richgalloway said, if by configuration you mean copying over all the stuff in $SPLUNK_HOME, that means simply copying your whole installation in whatever version it is right now. Since apps are simply just collections of files, some of them being an important part of the overall configuration, you usually can't just not copy them and expect everything to work as it used to. You probably could just copy over indexed data - that should work. But then you'd need to _at least_ copy over index definitions as well. And probably some datamodel definitions and acceleration configurations (although those you can rebuild but it takest time). And then you'll find yourself wanting to preserve some other configuration items, reports, dashboards and... in the end it turns out it's better to just upgrade the whole thing as it was. You could try to manually isolate the "Splunk config" items, copy them over with indexed data to the new instance and then try to (again - manually) migrate settings from each app separately but that will mean you have to install each app from scratch, check if the app didn't change from the version you use now to a new version (a huge part of your apps probably still uses python 2 so there are definitely changes in the apps themselves). There are some possible paths out of your 7.2.3 but they do involve a lot of effort which you might actually save by doing those multiple upgrades in place.