Migrate your 32-bit Splunk Windows installation to 64-bit

Migrate your 32-bit Splunk Windows installation to 64-bit

If you've already deployed a 32-bit version of Splunk for Windows on 64-bit hardware in anticipation of 64-bit support, this topic walks you through what you must do to migrate your installation in place to the 64-bit version of Splunk.

• For additional information on migrating a Splunk instance, review "Migrate a Splunk Install" in the Distributed Deployment Manual.

1. Stop the Splunk services on the 32-bit installation (splunkd and splunkweb). You can use the command line or the Services control panel:

You can start and stop the following Splunk processes via the Services control panel:

• Server daemon: splunkd
• Web interface: splunkweb

You can also start, stop, and restart both processes at once by going to C:\Program Files (x86)\Splunk\bin and typing

>  splunk.exe [start|stop|restart]

Note: On 64-bit versions of Windows, the default value of %SPLUNK_HOME% for the 32-bit version of Splunk is C:\Program Files (x86)\Splunk.

2. Make a copy of the %SPLUNK_HOME%\var\ and %SPLUNK_HOME%\etc\ directories.

This will include your indexes (by default, your main Splunk index is located in %SPLUNK_HOME%\var\lib\splunk\) and any configuration files you've changed in %SPLUNK_HOME%\etc\local and %SPLUNK_HOME%\etc\apps.

3. Uninstall the 32-bit version of Splunk using the Add or Remove Programs option in the Control Panel.

Important: You must perform this step before installing the 64-bit version of Splunk.

4. Install the 64-bit version of Splunk using the instructions in "Install on Windows" in the Installation Manual.

5. Start up Splunk and verify basic functionality.

Note: You can verify basic functionality by logging in and adding an input, and then seeing that the input collects data.

6. Stop the Splunk services (splunkd and splunkweb) again.

7. Copy the following files and directories from the copy of %SPLUNK_HOME%\etc\ that you set aside (indexes and configuration files) back into the same locations in the new installation.

%SPLUNK_HOME%\etc\myinstall\splunkd.xml

%SPLUNK_HOME%\etc\system\local

%SPLUNK_HOME%\etc\system\lookups

%SPLUNK_HOME%\etc\apps

%SPLUNK_HOME%\etc\auth

%SPLUNK_HOME%\etc\deployment-apps (if the Splunk instance is a deployment server)

%SPLUNK_HOME%\etc\log-local.cfg (if a local version was manually created)

%SPLUNK_HOME%\etc\openldap

%SPLUNK_HOME%\etc\splunk.license

%SPLUNK_HOME%\etc\splunk-launch.conf

%SPLUNK_HOME%\etc\passwd

%SPLUNK_HOME%\etc\users

Keep in mind that for the 32-bit version of Splunk, the default value of %SPLUNK_HOME was C:\Program Files (x86)\Splunk and the 64-bit version of Splunk will be in C:\Program Files\Splunk.

8. In your new 64-bit installation of Splunk, rename the %SPLUNK_HOME%\var\ directory to something else (like %SPLUNK_HOME%\var.delete\) and then copy over the %SPLUNK_HOME%\var\ directory you saved from the 32-bit version of Splunk.

You can later delete the var.delete directory.

9. Restart Splunk, and check your configurations.

• Was this topic useful?
• Post a comment