Splunk Search

Move the Splunk from one server to another server

SplunkCSIT
Communicator

What is the steps to move the Splunk, including the search and indexes from serverA to serverB? thks

Tags (1)
1 Solution

dshpritz
SplunkTrust
SplunkTrust

http://wiki.splunk.com/Deploy:Migrating_a_Splunk_Install

Basically:

  1. install Splunk on the new system
  2. stop the old Splunk
  3. copy over your Splunk install directory (/opt/splunk)
  4. start Splunk on the new system
  5. Wipe hands on pants.

View solution in original post

mehtas
Explorer

But what if for the old System i only have the web link to see what does it have like dashboards but i am not able to figure out how to locate data from its back end.

Can you let me know how should i transfer data from one server to another

0 Karma

dshpritz
SplunkTrust
SplunkTrust

http://wiki.splunk.com/Deploy:Migrating_a_Splunk_Install

Basically:

  1. install Splunk on the new system
  2. stop the old Splunk
  3. copy over your Splunk install directory (/opt/splunk)
  4. start Splunk on the new system
  5. Wipe hands on pants.

xxdesmus
Explorer

Except not really, at least based on my experience from today. This completely didn't work. I ended up the following: "WARNING: web interface does not seem to be available!" and could not find any kind of useful diagnostic information to troubleshoot the problem.

0 Karma

tobywatkins1
Engager

step 6. Profit
step 7. eat cheetoes

0 Karma

piebob
Splunk Employee
Splunk Employee

+1 for step 5

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...