topic How to migrate Splunk by changing the existing instance to become forwarder/secondary indexer? in Installation

How to migrate Splunk by changing the existing instance to become forwarder/secondary indexer?

quahfamili — Mon, 15 Jun 2020 21:26:37 GMT

Hi all,

I had a Splunk instance that used to be ingesting data local data and hence it is the indexer as well as the search head.

I'm thinking of using it as a backup(duplicating)/secondary indexer and forward the data to a new server (migrated server with duplicated data).

Is it possible to do this? What is the step I need to take?

Thanks in advance.

Re: Migrating splunk by changing the existing splunk to become forwarder/secondary indexer

adonio — Sat, 20 Jan 2018 03:07:30 GMT

hello there,

everything is possible, what is it that you would like to accomplish?
do you need backup? if you can keep the data and the server (old indexer) no need to forward it to a new insatnce.
install splunk on new server, add the old server as a search pear to the new splunk server. read here:
https://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/Configuredistributedsearch
ad you are ready to rock and roll

hope it helps

Re: Migrating splunk by changing the existing splunk to become forwarder/secondary indexer

quahfamili — Sat, 20 Jan 2018 08:22:03 GMT

Hi I want the older server to remain and forward the events to a new server, so there is a duplicate of server.

The issue here is that the old server is very slow but I want to keep it until everything is stablised before shutting the index. The older server will remain to process some file and forward to the newer server but not indexing anymore.

Possible? How?

Re: Migrating splunk by changing the existing splunk to become forwarder/secondary indexer

nickhills — Sat, 20 Jan 2018 12:30:55 GMT

On the 'old' indexer:
In Settings> Forwarding and receiving > Forwarding Defults
Enable "Store a local copy of forwarded events?"

Then go to Settings> Forwarding and receiving > Forward data
Click "New" and enter the ip:port of your 'new' indexer.

What this will do is configure your indexer to work as a combined indexer & forwarder.
Copies of the data will be saved on your 'old' indexer and forwarded to your 'new' indexer.
When you are happy everything is working properly, you can change your forwarders to send directly to the 'new' indexer to remove your 'old' indexer from the burden.

Re: Migrating splunk by changing the existing splunk to become forwarder/secondary indexer

quahfamili — Tue, 30 Jan 2018 09:38:35 GMT

Hi @nickhillscpl

I would want to ask you :

You mentioned "When you are happy everything is working properly, you can change your forwarders to send directly to the 'new' indexer to remove your 'old' indexer from the burden."

How do I actually do it? Do i just changed the license to forwarder license, so it would not consume my data ingest limit?