Well given the lack of responses I went with trial and error. The end result is that I have migrated 32bit splunk to a new 64bit server. This was achieved by stopping the splunk services, backing up the splunkdb folder (I have it on a separate drive) and program files folders, building the new server, installing a vanilla splunk installation on the new server, stopping the splunk services and then copying the splunkdb and program files folders over the new installation. Then restart the services. I still want to migrate from 32bit to 64bit but this can wait for another day. ... View more

If all the data is there and intact, you should be able to Reinstall Splunk Restore the Splunk etc directory from a recent backup Start Splunk In addition to making sure that your indexed info is all there, this will also restore your licenses, your users' saved searches, etc. etc. This is not the only way to get service restored, but it is the easiest way that I know. If you can't restore the Splunk etc directory, then you will need to reconstruct the configuration files; this would be a PITA. The data is described in indexes.conf - but that is only part of what you really need. It's great that your data partition survived intact. Post back if you need more help. ... View more