topic Re: Migrate Index without shutdown in Splunk Dev

Migrate Index without shutdown

mdmurtazaali — Fri, 10 Mar 2017 14:26:51 GMT

Hi There, We have two indexer (not clustered) but on DNS roundrobin. We need to migrate the indexers to the new hardware and we are planning to do that one by one. For indexer 1 Is there any way to:
1. Copy the files to the new server without shutting down splunk?
2. Can the indexer 1 be readonly from search head?

Thanks,

Re: Migrate Index without shutdown

jcrabb_splunk — Fri, 10 Mar 2017 16:41:10 GMT

Here is our documentation that discusses migrating:

http://docs.splunk.com/Documentation/Splunk/6.5.2/Installation/MigrateaSplunkinstance

As you will see in this section, you will need to stop Splunk:

1. Stop Splunk Enterprise on the host from which you want to migrate.
2. Copy the entire contents of the $SPLUNK_HOME directory from the old host to the new host.
3. Install the appropriate version of Splunk Enterprise for the target platform.
4. Confirm that index configuration files (indexes.conf) contain the correct location and path specification for any non-default indexes.
5. Start Splunk Enterprise on the new instance.
6. Log into Splunk Enterprise with your existing credentials.
7. After you log in, confirm that your data is intact by searching it.

While you can make an index read-only, in order to migrate properly, you will need to stop Splunk.

Re: Migrate Index without shutdown

puneethgowda — Fri, 10 Mar 2017 16:45:01 GMT

Answer for your question is downtime is must

Re: Migrate Index without shutdown

mdmurtazaali — Fri, 10 Mar 2017 18:49:57 GMT

Thanks @Jcrabb!