Installation

Splunk migration - missing data

Branden
Builder

Hello!

We recently migrated our Splunk instance (running v7.1.2) to a new server, also running 7.1.2. Prior to migration, on the original server, we rolled hot buckets to warm, then synced all buckets (warm and cold) to the colddb indexes of the target server.

This worked fine, except we have an 8-hour gap of missing logs. This gap was at the time of our final data sync, not surprisingly. We did another diff and found some buckets that weren't copied over. No big deal, we copied them over... but we're still missing 8 hours of data.

How do we go out getting that 8-hour gap filled in with its events? I'm not sure where else to check, but am wondering if we missed a step somewhere. We still have access to the buckets on the original server if we need to get to them.

Also, we are (were) planning to upgrade the new Splunk server to the latest 7.2 release. Would it be a bad idea to perform this upgrade while troubleshooting missing events? Sounds like it might be.

Does anyone have any suggestions?

Thanks!

Labels (1)

woodcock
Esteemed Legend

You manually moved the warm buckets to cold?

0 Karma

Branden
Builder

That is correct. I read somewhere on here that it was okay to do that.
Should we have taken a different approach? Everything appears to be fine except for that small gap in events...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...