Getting Data In

How to forward already indexed data after converting Splunk into a Forwarder

wbordeau
Explorer

I configured my original Splunk installation to forward data to newer, faster hardware but noticed only data after this change has been forwarded. How do I move over all the other data that has been indexed on the original server up to that point?

Also, how do I configure the original Splunk installation to be a regular forwarder? I want the Splunk receiver to handle indexing and searching only.

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi wbordeau

maybe this helps:

http://www.splunk.com/wiki/Deploy:Migrating_a_Splunk_Install
http://www.splunk.com/base/Documentation/latest/Admin/Moveanindex

regards

addition: your old indexer will only forward new data, the old already indexed data will stay.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...