topic Re: Migration of Indexer clustering to new servers in Splunk Enterprise

Migration of Indexer clustering to new servers

dvohra — Tue, 23 Feb 2021 15:32:18 GMT

Hi All. I am working on Splunk migration project which involves moving of Splunk instances to new servers. Till now I managed to document the steps of CM, Deployer and SHC clustering. I am unable to find any detailed steps for Indexer clustering. Can anyone in this forum guide me with the procedure. In our environment Splunk is running with Indexer clustering(2 servers). Thanks !

Re: Migration of Indexer clustering to new servers

isoutamo — Tue, 23 Feb 2021 20:50:34 GMT

here is old answer to this question https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platform-Linux-but/m-p/541011#M5020

r. Ismo

Re: Migration of Indexer clustering to new servers

dvohra — Tue, 23 Feb 2021 21:21:00 GMT

@isoutamo Yes. So as per my understanding the procedure is

1. stop Old Indexers and forwarders

2. Install Splunk on 2 new Indexers(enable clustering) to CM and integrate them with SHC just like a new setup.

3. Copy useful config files or Splunk DB directory from Old to New servers.

4. Point the forwarders to new Indexers.

5. Start the new indexers and forwarders.

Re: Migration of Indexer clustering to new servers

dvohra — Wed, 24 Feb 2021 14:20:36 GMT

@isoutamo . Could you please confirm. Many thanks !

Re: Migration of Indexer clustering to new servers

isoutamo — Thu, 04 Mar 2021 15:37:37 GMT

my preferred way is extend current cluster with those new nodes an after that remove old nodes. That way you could do it with minimum interruption for service. If you are using (you should) indexer discovery then there is no need to update forwarders configuration for indexers as that has managed automatically.

of course you could do that part manually as you propose, but as I said I prefer other way.

r. Ismo

Re: Migration of Indexer clustering to new servers

dvohra — Thu, 04 Mar 2021 17:30:09 GMT

Thank you for replying. One last question as we add two new Indexers to the CM, do we need to update the RF and SF also ? Presently the value is set to 2.

Re: Migration of Indexer clustering to new servers

isoutamo — Thu, 04 Mar 2021 19:15:47 GMT

No need to update those. Just add nodes, then rebalance and then remove old ones. I’m not sure if rebalancing is actually needed, but In our cases it was mandatory do first rebalancing as we have much more nodes on new sites.