https://community.splunk.com/t5/Getting-Data-In/convert-a-stand-alone-splunk-instance-to-a-dedicated-indexer/m-p/38056#M6977 <P>You should read this whole section of the docs carefully:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Whatisdistributedsearch#What_search_heads_send_to_search_peers">About distributed search</A></P> <P>The basic process is:</P> <OL> <LI>Install a dedicated search head.</LI> <LI>copy any apps you have to the new search head. Remove any inputs that you have so you are not receiving or indexing on the new search head.</LI> <LI>enable distributed search on the search head.<BR /></LI> <LI>Add the old indexer as a search peer on the search head.</LI> <LI>search for something and look to see if you see the indexer in the splunk_server field</LI> </OL> <P>After that, it is up to you if you want to disable the web ui on the old indexer. It is also up to you if you want to organize your apps better so only the correct pieces are on the search head. This isn't strictly necessary because splunk will ignore settings that do not apply to the type of server but it is a best practice.</P> <P>I would read this to help you understand how configurations work in a distributed deployment:</P> <P><A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F">Where do I configure my splunk settings</A></P> Fri, 17 May 2013 13:27:22 GMT okrabbe_splunk 2013-05-17T13:27:22Z https://community.splunk.com/t5/Getting-Data-In/convert-a-stand-alone-splunk-instance-to-a-dedicated-indexer/m-p/38055#M6976 <P>Hi All,</P> <P>Currently there is just one stand alone splunk server running for the entire company, we decided to change the architecture and add a search head and use the existing server as a dedicated indexer. I want to know:<BR /> 1.How can I do that (get the search component off of the existing server and make it a dedicated indexer)?<BR /> 2.How to migrate the search configuration from the existing Splunk to the search head?</P> <P>Thanks,<BR /> M</P> Fri, 17 May 2013 13:18:48 GMT https://community.splunk.com/t5/Getting-Data-In/convert-a-stand-alone-splunk-instance-to-a-dedicated-indexer/m-p/38055#M6976 MarMoh 2013-05-17T13:18:48Z https://community.splunk.com/t5/Getting-Data-In/convert-a-stand-alone-splunk-instance-to-a-dedicated-indexer/m-p/38056#M6977 <P>You should read this whole section of the docs carefully:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Whatisdistributedsearch#What_search_heads_send_to_search_peers">About distributed search</A></P> <P>The basic process is:</P> <OL> <LI>Install a dedicated search head.</LI> <LI>copy any apps you have to the new search head. Remove any inputs that you have so you are not receiving or indexing on the new search head.</LI> <LI>enable distributed search on the search head.<BR /></LI> <LI>Add the old indexer as a search peer on the search head.</LI> <LI>search for something and look to see if you see the indexer in the splunk_server field</LI> </OL> <P>After that, it is up to you if you want to disable the web ui on the old indexer. It is also up to you if you want to organize your apps better so only the correct pieces are on the search head. This isn't strictly necessary because splunk will ignore settings that do not apply to the type of server but it is a best practice.</P> <P>I would read this to help you understand how configurations work in a distributed deployment:</P> <P><A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F">Where do I configure my splunk settings</A></P> Fri, 17 May 2013 13:27:22 GMT https://community.splunk.com/t5/Getting-Data-In/convert-a-stand-alone-splunk-instance-to-a-dedicated-indexer/m-p/38056#M6977 okrabbe_splunk 2013-05-17T13:27:22Z