Hi,
I am moving entire index from one server to another server. I am using deployment server to deploy the index and/of forwarder.
So, I deployed forwarder and searchhead on new box.
This is what I am planning:
1) stop splunk on old indstance (both forwarder and search head process)
2) copy entire index folders to new server
3) start splunk on new server.
Should I need to start splunk procesees before moving indexes or after moving indexes after initial installation? Because I think starting splunk on new server after initial installation will create some default directoris. And I think if I copy indexes prior to restart..it may overwrite and will have issues.
Also, how to make sure permissions set are correct when moving from one server to another?
Thank You.
You can copy the index files before starting splunk.
If you are on a linux box, archive/unarchive with tar and it will retain the proper permissions.
In case the userid(uid) or groupid (gid) on the new box are different, run
chown -R splunkuser:splunkgroup $SPLUNK_HOME/var/lib/splunk
You can copy the index files before starting splunk.
If you are on a linux box, archive/unarchive with tar and it will retain the proper permissions.
In case the userid(uid) or groupid (gid) on the new box are different, run
chown -R splunkuser:splunkgroup $SPLUNK_HOME/var/lib/splunk
ok..thanks that worked.