Thank you for sharing your detailed process and the issue you're encountering with JSON log ingestion. Your testing approach was thorough, but there are a few key points to address: Props.conf location: The primary parsing settings should be on the indexers, not the search heads. For JSON data, you typically only need minimal settings on the search head. Search head settings: On the search head, you can simplify your props.conf to just: [yoursourcetype] KV_MODE = JSON This tells Splunk to parse the JSON at search time, which should give you the field extractions you're looking for. In order to onboard this properly you can also set MAGIC6 props on your indexers. https://community.splunk.com/t5/Getting-Data-In/props-conf/m-p/426134   Try to run the below search to figure out what app is taking precedence.   | rest splunk_server=local /services/configs/conf-props/YOURSOURCEYPE| transpose | search column=eai:acl.app   Please UpVote/Solved if this helps. ... View more

I had a reply from the Splunk Support, it seems that since a while init.d is not supported anymore as mentioned here: https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/ConfigureSplunktostartatboottime   "The init.d boot-start script is not compatible with RHEL 8 and higher. You can instead configure systemd to manage boot start and run splunkd as a service. For more information, see Enable boot start on machines that run systemd."   In fact I have this issue on a Oracle Linux 8 machine.   ... View more

Hi It's just like @richgalloway said, there is no supported way how anyone can do it. You could try the next if it works, BUT do it by your own risk/responsibility! I haven't test this! When you are reading that splunk docs it said that it don't convert existing buckets to clustered when you add an old individual indexer to cluster. Based on that you could try (IF You have TEST environment to do it) to emulate this behaviour as moving those buckets to your cluster. BUT it needs at least the next: You cannot have the same name for any clustered index what you are moving (eg. any internal indexes) You cannot create those new buckets as a clustered buckets If you cannot fulfil above, then you cannot try the next! Instead of you should ask help from Splunk Professional Services! Stop old indexer  transfer wanted buckets from source peer to individual target node (not _* buckets can moved or any already clustered indexed with same names!)  Copy $SPLUNK_DB/<index name>.dat file from source to target peer for every moved index on every indexer which have that index Update CM's indexes conf with those new indexes. Be sure that those new indexes have attribute repFactor = 0 not as auto! Apply a new indexes conf on your CM to your cluster. Test, test, test. If this fails you will be in situation where your cluster is probably down. To fix that you probably must manually edit indexes.conf files to remove those index configurations from it. It's also needed to remove from CM and do a new apply. But as I said. You must test this first on your test environment, then ensure that those requirements are fulfil and reserve some time for possible downtime when you doing that on production. And once again, You will do it by your own risk and responsibility!!! r. Ismo ... View more

Hi as other already said this is doable. Here is my old post how to do it https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platform-Linux-but/m-p/538062 Of course in your case you must take care of connection between those sites. That must be enough fast to get this working. One other notice is that you must have same splunk version on all nodes in cluster. So you must select between update old first or install old version to AWS first. Based on amount of your data and connection speed between sites you could do this or other option is just create a new idx cluster on AWS and after it is in use then create additional (temporary) cluster for old onprem data and add it as a second cluster for your search heads. That way you could utilise e.g. snowball to transfer data from onsite to AWS (if your connection cannot handle it with reasonable time).   r. Ismo ... View more