Essentially if the only change is OS it should be fairly easy to migrate. Ensure the new systems have the same IP or Hostnames depending on whether you use names or IPs in the configs. Ensure the splunk user and group are created on the new servers, follow instructions for installing by tar file. Stop the current servers, tar up the /opt/splunk folder and any data store folder. Then untar them onto the new boxes.  ... View more

I had this same issue after upgrading to Splunk 9.1.0.2 and found there was a missing choice value under the All Pools option inside of the view $SPLUNK_HOME$/etc/apps/splunk_monitoring_console/default/data/ui/views/license_usage_historic.xml    You will need to go in and manually update the xml at CLI or with the text editor of your choice. Adjust the choice value for the input from the blank value to the asterisk wildcard as shown below.     <input type="dropdown" searchWhenChanged="true" token="pool"> <label>Pool</label> <showClearButton>false</showClearButton> <fieldForLabel>name</fieldForLabel> <fieldForValue>value</fieldForValue> <search> <query> | rest splunk_server=$splunk_server$ /services/licenser/pools | rename title AS pool | search [rest splunk_server=$splunk_server$ /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval name=pool | eval value="pool=\"". pool . "\"" | table name value </query> </search> <choice value="*">All Pools</choice> <default>All Pools</default> <change> <condition value=" "> <set token="size_search">dmc_licensing_stack_size_srch</set> <set token="sz_clause">stacksz</set> </condition> <condition value="*"> <set token="size_search">dmc_licensing_pool_size_srch</set> <set token="sz_clause">poolsz</set> </condition> </change> </input>     ... View more

I know this is an old thread, but just ran into this in my own instance running Splunk 8.2.8 and Cisco eStreamer eNcore for Splunk (3.7.4). The problem is that in the encore.conf file it is using a different file path than what is in the splencore.sh for datapath. That is why the clean-up script isn't working properly. "uri": "relfile:///../../data/encore.{0}.log" } } ], The file location is different than what is in the default.conf and is causing it to save data in the full path of $SPLUNK_HOME/etc/apps/TA-eStreamer/data rather than the clean hardcoded path in the app of /opt/splunk/etc/apps/TA-eStreamer/bin/encore/data Hopefully this will help someone else get their system cleaning data properly. Either adjust the value in encore.conf or adjust the clean path in splencore.sh to the appropriate location. ... View more