https://community.splunk.com/t5/Splunk-Enterprise/migrating-to-new-hardware/m-p/680027#M18838 <P>Splunk offline --enforce-count or data rebalance which one is better in case of migrating to new hardware and do i have to add peer to manual detention in indexer cluster before running a data rebalance or splunkoffline?</P><P>&nbsp;</P> Fri, 08 Mar 2024 06:57:13 GMT KulvinderSingh 2024-03-08T06:57:13Z https://community.splunk.com/t5/Splunk-Enterprise/migrating-to-new-hardware/m-p/680027#M18838 <P>Splunk offline --enforce-count or data rebalance which one is better in case of migrating to new hardware and do i have to add peer to manual detention in indexer cluster before running a data rebalance or splunkoffline?</P><P>&nbsp;</P> Fri, 08 Mar 2024 06:57:13 GMT https://community.splunk.com/t5/Splunk-Enterprise/migrating-to-new-hardware/m-p/680027#M18838 KulvinderSingh 2024-03-08T06:57:13Z https://community.splunk.com/t5/Splunk-Enterprise/migrating-to-new-hardware/m-p/680050#M18839 <P>Use <FONT face="courier new,courier">splunk offline --enforce-count</FONT> to migrate to new hardware.&nbsp; A rebalance will shuffle buckets around, but won't remove the old indexer.&nbsp; If you're only replacing a single indexer then manual detention is not necessary.&nbsp; However, if this is one of many migrations than consider setting manual detention on each old indexer so they don't receive buckets from the others that are taken down.&nbsp; It will spare the system from potentially moving the same bucket multiple times.</P> Fri, 08 Mar 2024 13:27:23 GMT https://community.splunk.com/t5/Splunk-Enterprise/migrating-to-new-hardware/m-p/680050#M18839 richgalloway 2024-03-08T13:27:23Z