Is there any way to downgrade from 6.5 to 6.3 ?

[leo_wang]

Hi,

I just have upgraded our splunk from v6.3 to v6.5....
But it seems this version of Splunk required more CPU power and Disk I/O than older version , our Splunk runs very slowly after upgrade...

I am considering to downgrade Splunk to v6.3 , but unfortunately , I didn't backup our indexes files.
( And I can't , because there are 2TB of index data in our server....)

It seems the data format of indexes files has been changed in this version , When I downgraded the splunk program to v6.3 , I found I lose the data that collect in these few days ( by splunk v6.5) .......

Any idea to downgrade Splunk safely ?

[gjanders]

Perhaps you need to further investigate the Splunk instance before considering a downgrade?
Most Splunk upgrades will improve performance...

Are you sure it is significantly different post-upgrade?
You may wish to note that the data model acceleration will re-build post upgrade...