This is more of a 'feeler' thread. But i'm currently maintaining a Splunk 7.0 instance. And would like to bring it up to Splunk 9.0.

My thoughts on this are either:

• Go through the upgrade process of upgrading Splunk 7.0 up to Splunk 9.0
• Deploy a new Splunk 9.0 instance. And then migrate the data from Splunk 7.0 to Splunk 9.0

This is something I haven't done before. So I wanted to get an idea what the community's thinking is on this. And yes, I do have Splunk support.

But they technically won't support Splunk 7.0... though it's not like I can flip the script and say, "We want to import data from Splunk 7.0 into Splunk 9.0." lol.