topic Re: Clone Splunk Indexer? in Getting Data In

Clone Splunk Indexer?

adalbor — Thu, 14 May 2020 14:59:51 GMT

Hey All,

Off the wall question and was curious if anyone has tried this or not and if its advisable. Looking to add some new indexers (linux) to our cluster and in an attempt to save time our server admin has suggested cloning an existing indexer and performing whatever changes need to be made to hostname, config files, etc.

Two options I see:
1) Clone entire system and use clone-prep-clear-config. Will this even work with an Indexer?
2) Clone entire system and nuke /opt/splunk directory and do a fresh install. Are there any other concerns with this method?

Thanks!
Andrew

Re: Clone Splunk Indexer?

gcusello — Thu, 14 May 2020 15:04:02 GMT

Hi @adalbor,
how much time do you save in this way?
if you'll forget some step in your cloning procedure you'll lose more time than to start with a new Splunk installation!

Ciao.
Giuseppe

Re: Clone Splunk Indexer?

adalbor — Thu, 14 May 2020 15:11:09 GMT

So due to the fact that our Indexers are Azure servers and required quite a bit of OS customization to align with our company's standards, that is why I was bringing this question up. I am not a fan of the idea and understand the pitfalls and potential issues that could occur down the road but wanted to ask just to do my due diligence.

I personally was thinking clone the server then nuke the Splunk installation directory so the sys admin saves time in setup and I can start from a "fresh install". Just wasn't sure if that would take care of all remaining artifacts from the install.

Re: Clone Splunk Indexer?

gcusello — Thu, 14 May 2020 15:13:51 GMT

I found problems in past when I had a cluster with old parameters, so I maintain My idea: how much time do you save?

Ciao.
Giuseppe

Re: Clone Splunk Indexer?

adalbor — Thu, 14 May 2020 15:27:10 GMT

Did you perform any type of config cleanup? Did you leave the /opt/splunk/ directory intact?

Re: Clone Splunk Indexer?

gcusello — Sun, 17 May 2020 09:13:34 GMT

Hi @adalbor,
you hate to manually modify many configurations:

hostname in inputs.conf and server.conf;
server.conf for cluster,
etc...

I cannot be more detailed because I didn't do it because I don't like this idea.

Ciao.
Giuseppe

Re: Clone Splunk Indexer?

adalbor — Tue, 19 May 2020 13:57:29 GMT

Ok, thanks for the info Giuseppe. Was just gauging the community to see what my options were and to do due diligence.