What's best way to restore a Solaris Spark 4.0.7 archive to a X86 Linux 32 or 64bit Splunk 4.0.7 install?

[ram_malhotra]

I have archives on my Splunk Spark Solaris 4.0.7 installation that I would like to be restored on a new Splunk X86 Linux 32bit and 64bit Splunk 4.0.7 install. What's the best way to get this archive data migrated and searchable on the new Linux Splunk installation?

I have been successful in getting the Splunk Spark Solaris 4.0.7 archive loaded and searchable on a new Splunk Spark Solaris install; however using the same method with a X86 Linux Splunk install was not successful because the searches would hang indefinitely.

[gkanapathy]

I'm assuming that your archive is a Solaris SPARC, not Solaris x86. In that case, it's not really possible to move the data over directly, since the SPARC and x86 processors have different endian-ness, and so the Splunk indexes are not compatible. (Sparc would compatible with, for example AIX POWER architecture indexes, and Solaris x86 and Linux x86 and Windows would be compatible.) The only way to handle with will be to export the data from the SPARC system using the Splunk command line export or exporttool, and then import it into the x86 system.