Hi,
I just have upgraded our splunk from v6.3 to v6.5....
But it seems this version of Splunk required more CPU power and Disk I/O than older version , our Splunk runs very slowly after upgrade...
I am considering to downgrade Splunk to v6.3 , but unfortunately , I didn't backup our indexes files.
( And I can't , because there are 2TB of index data in our server....)
It seems the data format of indexes files has been changed in this version , When I downgraded the splunk program to v6.3 , I found I lose the data that collect in these few days ( by splunk v6.5) .......
Any idea to downgrade Splunk safely ?
Perhaps you need to further investigate the Splunk instance before considering a downgrade?
Most Splunk upgrades will improve performance...
Are you sure it is significantly different post-upgrade?
You may wish to note that the data model acceleration will re-build post upgrade...