Installation

Migration - will Splunk re-index a directory?

Branden
Builder

Hello. We are migrating to a new Splunk server.

In our current environment, Splunk receives syslog by crawling /logs/////. The /logs directory is an NFS mount.

Our current plan is to migrate our buckets over to our new Splunk server, including the buckets with syslog (which is in the main index). Then we will NFS mount /logs on the new Splunk server. Then I became concerned... assuming the buckets have been migrated over, will Splunk re-index everything in /logs? Or will it just continue from where it left off? Our syslog events go to the main index, so I can't simply not migrate its index.

I would really prefer not to re-index all of /logs if I can avoid it. Will this be the case in our environment?

Thank you!

Labels (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, unless you migrate the fishbucket index, too. Be sure to copy that after you shutdown your old Indexer for the last time.

View solution in original post

woodcock
Esteemed Legend

Yes, unless you migrate the fishbucket index, too. Be sure to copy that after you shutdown your old Indexer for the last time.

Branden
Builder

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...