topic Re: switch forwarders to new indexer in Getting Data In

switch forwarders to new indexer

rameshlpatel — Wed, 28 May 2014 16:00:20 GMT

Hi,

I have existing indexer with 6.0 version and same version for all forwarders.

Now we got new splunk physical server with version 6.1.1,

Not I am switching forwarder to new server by replacing server attribute. However its not able to forward to new.

please suggest me what i have to consider before moving to new server ? Is data file will affect to due to this ? Please suggest me solution.

outputs.conf
[tcpout]
defaultGroup=DBGroup

[tcpout:DBGroup]
server =alpputl018:9997

rameshlpatel — Wed, 28 May 2014 16:01:48 GMT

IS data monitoring pointer will affect due to this ?

rameshlpatel — Wed, 28 May 2014 16:21:22 GMT

Adding more details. _internal logs are seeing in new server but not application log.

harald_leitl — Wed, 28 May 2014 16:21:32 GMT

is tcp port 9997 open on new index server?

rameshlpatel — Wed, 28 May 2014 16:22:21 GMT

Yes. its opened

harald_leitl — Wed, 28 May 2014 16:29:10 GMT

what about indexes.conf? same config on old and new server?

rameshlpatel — Wed, 28 May 2014 16:49:05 GMT

Not played with indexes.conf in old or new server.

linu1988 — Wed, 28 May 2014 16:55:38 GMT

First step before migrating between platform is to check the network connectivty

Ping alpputl018 telnet alpputl018 "receiving_port/9997"

new server will not be having the receiving configured. Check it right away.

Check the forwarder logs what is the issue if is not able to connect.

Thanks,
L