topic Re: Migrating Heavy Forwarder to a new server in Getting Data In

Migrating Heavy Forwarder to a new server

cnuguri_ncc — Fri, 07 Aug 2020 16:19:03 GMT

Hi All,

I have inherited a HF running on a Linux server collecting data from several cloud sources using the inputs from below TAs, that need to be moved to a newly built Linux server (no Splunk version upgrades).

azure_event_hub
azure_security_center_input
digital_shadows_searchlight
microsoft_graph_security
MS_AAD_audit
MS_AAD_signins
mscs_azure_audit
mscs_azure_resource
splunk_ta_o365_management_activity
windows_defender_atp_alerts

Can you please recommend any procedures and best practices to make sure there is no data duplication ?

Thinking of the below ways, will any of these work and which is better ?

a. Stop Splunk on old host and copy Splunk directory to new host.
b. Change the splunk server/instance name to match the new host.
c. Start splunk on the new host.

2. Install fresh Splunk on new host, and configure TAs, is there a way to move any checkpoints (or something similar to fishbuckets ? ) from the old HF, so that the TAs pull data from where it was stopped on the existing HF ?

Thanks a lot in advance

Chaith

Re: Migrating Heavy Forwarder to a new server

thambisetty — Fri, 07 Aug 2020 16:56:36 GMT

Best way is to move Splunk app on HF since you have checkpoints for modular inputs.

stop splunk on old instance.

create same splunk user which is used on existing server on new server.

just copy $SPLUNK_HOME to new splunk instance

and change instance name and hostname in

system/local/server.conf and inkuts.conf if you are going to have new hostname to new server you have configured. You can continue using same hostname if you are decommissioning existing HF.

then start splunk on new instance.

Re: Migrating Heavy Forwarder to a new server

cnuguri_ncc — Mon, 10 Aug 2020 08:15:58 GMT

Thanks a lot !

Re: Migrating Heavy Forwarder to a new server

thambisetty — Mon, 10 Aug 2020 14:18:13 GMT

Great. You are welcome.

Re: Migrating Heavy Forwarder to a new server

fahmed11 — Mon, 24 Jun 2024 17:21:29 GMT

Did this work? Did you discover that you had to implement additional steps to make it work?

Thanks,
Farhan