Migrating different Splunk indexers to a new environment

[Branden]

Looking for advice here...

We're in the midst of a re-org and, as a result, separate Splunk environments are going to be merged.

We have an environment on AIX running a Splunk 4.1.7 indexer, receiving data from a bunch of LWFs. We have another environment on Solaris running Splunk 3.x, receiving most of its data from named pipes.

The target environment is a Linux/x86 environment running a Splunk 4.1.x indexer. We would combine our licenses into one big license.

We want the ability to search/analyze legacy data from the AIX/Solaris indexes.

At first, I figured we'd simply move the indexed data to the new Linux environment. But my understanding is that it's not possible to "migrate" indexed data across different architectures. That is, our AIX/Solaris indexer's data can't be migrated to the Linux indexer. Is that the case?

One suggestion I heard was to leave the AIX/Solaris indexers in place and use them as search peers, but not use them to index data. All new data would be indexed by the new Linux environment.

Does what I'm describing make sense? Does anyone have any suggestions on how to implement a migration like this?

Any suggestions welcome.

[Mick · Accepted solution]

Yes, it makes sense and yes, what you have heard is pretty accurate. Moving data from one architcture/file-system to another is usually not possible.

We have seen some cases where moving data from Solaris to Linux has worked, if the Solaris box was x86 arch. If you have a SPARC box, then it's just not going to work. If you want to confirm, you can try moving just one bucket as a test.

The easiest option for you is the one you have described, setting up an instance on both architectures to act as search peers until such time as that data is no longer needed. Another, more time-consuming option would be to export the data from the original index and import it into the new ones, using a method similar to the one described here

Migrating data from one instance to another isn't complicated, and is simply a case of copying the buckets from one location to another, as described here

[gkanapathy]

...this limitation will go away starting with...

[gkanapathy]

The problem isn't generally different architectures, but different enddianness of the OS/architectures. Linux/x86, Windows x86, MacOS x86 and Solaris x86 are compatible; and AIX/POWER, Solaris/SPARC, HP-UX/PA-RISC, HP-UX/Itanium, and MacOS/PPC are compatible with each other.

Note that this limitation will away starting with data that was indexed in a 4.2 or later system, though legacy data will still carry the same restrictions.

[Branden]

Mick,
Thank you for the response and confirming my suspicions. We have to discuss it here, but it sounds like setting them up as search peers is the best way to go. Thanks again!