Deployment Architecture

Moving splunk to a new server

bfay
Explorer

I am in the process to migrate our Splunk installation to a new server. I found how to move the Splunk index... a big part of the job!

Now I would like to know how I can move the configuration from our old server to the new one. Or maybe the configuration is part of the index?

Thanks,
Bernard

Tags (1)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Hello Bernard,

Your indexes are held in the location specified in your SPLUNK_HOME/etc/splunk-launch.conf. By default, if you aren't using any custom indexes, the location is under /opt/splunk/var/lib/splunk/. The configuration can be retained by copying $SPLUNK_HOME/etc/.

More on this topic can be found here:

http://www.splunk.com/wiki/Deploy:Migrating_a_Splunk_Install

View solution in original post

bfay
Explorer

Thanks, this is a very good start.

But I am not sure I can simply copy $SPLUNK_HOME/etc/. We are migrating from a CentOS 5 32-bit to CentOS 5 64-bit. I found some 32-bits files related to an installed app: pdfserver. But it seems the 64-bit binaries for this app have been installed at the same time as the 32-bit binaries. Should I understand from this the copy will be fine and the application pdfserver will be ok in the new environment?

Thanks,
Bernard

jbsplunk
Splunk Employee
Splunk Employee

Hello Bernard,

Your indexes are held in the location specified in your SPLUNK_HOME/etc/splunk-launch.conf. By default, if you aren't using any custom indexes, the location is under /opt/splunk/var/lib/splunk/. The configuration can be retained by copying $SPLUNK_HOME/etc/.

More on this topic can be found here:

http://www.splunk.com/wiki/Deploy:Migrating_a_Splunk_Install

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...