Data Migration Toolkit for Splunk

Moving indexed data from one Splunk deployment to another is usually a long, manual, error prone job: copying buckets by hand, renaming them for a cluster, fixing Windows paths, guessing at disk space, and hoping the counts match afterwards. Data Migration Toolkit for Splunk automates that work and shows you every step before anything moves. Supported paths: * Windows to Linux, in any topology * Single instance or distributed indexers to an indexer cluster * Indexer cluster to a single instance or to non clustered indexers * Indexer cluster to indexer cluster, including into a cluster that already holds data * Several deployments merged into one target * Like for like moves to new hardware or a new data center How it works: 1. Discover: read only REST and search queries inventory indexes, buckets, versions, sizes and readiness problems (index names Linux will not accept, missing journals, Windows paths in configuration, SmartStore, corrupt buckets). 2. Plan: a dry run report shows where every bucket goes, its new name, capacity per target indexer, size limit checks, the generated indexes.conf, and a runbook with the exact command for each host. Nothing moves until you approve it. 3. Copy: export and import are resumable, check a SHA256 for every bucket, never overwrite anything on the target, and never change the source except rolling hot buckets at cutover. 4. Validate: event counts per index per UTC day are compared on both sides, with an HTML report you can hand to the change approver. Dashboards on the target show live progress per plan, index and host. The source stays intact, so rollback is pointing forwarders back at it. A free browser based planner at augustschell.com builds the same plan from a discovery manifest, without uploading it. Not supported: SmartStore indexes and Splunk Cloud as a source or target. Free, by August Schell. Licensed under Apache 2.0.