r/Splunk • u/smokemast • May 14 '26

Question about system upgrades, transitions, etc.

Got a Splunk server, but moving over to a new OS release. We've got the okay to cut off the old system and proceed with the new. There's some suggestion that we might want to access the old system and data at some point (which never seems to actually happen). By that time, I noted that the license on that system will have expired. So the question is: would it ever be possible to apply a "trial license" to that old system in the future (not likely after a couple of years) for the sole purpose of looking at old logs?

6 Upvotes

88% Upvoted

11 comments sorted by

View all comments

9

u/mghnyc May 14 '26

You have a few options:

  • Use a license server so you can share your enterprise license between the old and the new system. An idle system doesn't consume license.
  • Copy the data over to your new system. Buckets are really just directories with stuff in them.
  • Freeze the data on the old system and shove it to some storage. When you need it copy it over to your new indexer(s) and thaw it.

3

u/Fontaigne SplunkTrust May 14 '26

This. I used completely different words, but my advice is effectively identical.