How to Migrate Logs from Arcsight Express to Arcsight ESM
I am looking any help/case studies/documents on how to migrate logs form Arcsight express to Arcsight ESM.
I am working on an opportunity where customer wants to upgrade from Express to ESM. Need to suggest upgrade methodology. Please help.
an option would always be to let the two ESM run parallel for your Online Retention Period. For that you would have to configure 2 Destinations on each Connector/Logger.
I don't know about the technical possibility of a real DB migration, I think ArcSight Professional Services offers something similar with their Migration from ESM 5.x to ESM 6 - maybe they have something equal for Express to ESM.
Thank you for the info.
Even if I direct the connector to both Express and ESM, at the end of the day when I decomission Express, how do I import the Express old logs into ESM.
I was referring to "Resource Migration to CORR-Engine" doc where there is good guidance in exporting ESM DB (oracle) to Express CORR (MySQL).