I have a windows server and it's OS got crashed but i have the splunk database in the another drive which is fine now the steps I have performed are in the new splunk installation are: 1. Copied the configurations of the previous splunk application from the backup i have in to the new application. 2. Changed the database location and created the database structure in another drive apart from C: drive. 3. Now from the earlier database i copied the indexed data in to the new data base where i have overwritten the already present indexes which are created as per the indexer configuration. 4. Now when i restart the splunk i am getting a "DIRTY_DATABASE File (.dirty_database)" file generated. 5. But i can see the data in the indexes when i ran a search So, the question is whether the procedure i followed is correct or is there any other way to do this Thanks, Your well wisher
... View more