Knowledge Management

Easiest Way to Transfer Summary Index Data?

mattcg
Explorer

What is the easiest way to transfer populated summary indexes from an old Splunk box over to a new instance?

We have weeks worth of computation summarized in our summary indexes, I'd like to be able to simply transfer it (only the summaries, not the raw data) over to our new instance so our histograms continue to function. We currently use 3 different indexes: summary_day, summary_hour, summary_minute.

Thanks!

*Edit: to clarify, the summaries we have took weeks of computation (hence, we don't have the time to run them all from scratch) - not that we simply have weeks of data summarized, otherwise I would just use the fill_summary_index.py script.*

Tags (2)
0 Karma
1 Solution

hulahoop
Splunk Employee
Splunk Employee

You can simply copy (or move) the directories where the summary indexes live to the new box in the same location. In your Splunk home directory where Splunk is installed look in var/lib/splunk. There should be directories for each of the summary indexes:

summary_daydb
summary_hourdb
summary_minutedb

To be safe, shut down Splunk then move the directories. Make sure your new Splunk instance is also stopped. Then you can start it up after the move completes.

Also, be sure to create the indexes using SplunkWeb or transfer the entries from indexes.conf.

View solution in original post

0 Karma

hulahoop
Splunk Employee
Splunk Employee

You can simply copy (or move) the directories where the summary indexes live to the new box in the same location. In your Splunk home directory where Splunk is installed look in var/lib/splunk. There should be directories for each of the summary indexes:

summary_daydb
summary_hourdb
summary_minutedb

To be safe, shut down Splunk then move the directories. Make sure your new Splunk instance is also stopped. Then you can start it up after the move completes.

Also, be sure to create the indexes using SplunkWeb or transfer the entries from indexes.conf.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...