@sswigart btw interesting scenario. This is not a comprehensive solution and providing some guidance on how to proceed in this case. As we do in any migration, firstly, ensure we have a fallback mechanism. In this case, keep the Windows Splunk server intact until the Linux migration is fully validated. This gives you a fallback if anything goes wrong. Secondly, since the environment is air gapped, you can use offline media (external drives, SSDs) for data transfer. Copy the entire Splunk db directory (all hot, warm, and cold buckets) from Windows to Linux. Make sure to stop Splunk service before copying to avoid partial buckets. Thirdly, you need to adjust Configurations - both system/local and app configurations. Also path changes like from C:\... to /opt/splunk/… for linux. On Linux, ensure directories are owned by the splunk user. Use the below command. chown -R splunk:splunk /opt/splunk/ Ensure version alignment, run the same Splunk Enterprise version on both Windows and Linux during migration. Validate disk space and filesystem compatibility (NTFS to ext4/xfs). Audit index names and configs for consistent casing to avoid mismatches since Linux is case‑sensitive. >> If this post addressed your question, you can: Give it karma to show appreciation 👍 Mark it as the solution if it solved your issue ✔️ Add a comment if you’d like more details ✏️ Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise. >>
... View more
