topic How to migrate indexes and fields in Knowledge Management

How to migrate indexes and fields

xsstest — Mon, 17 Apr 2017 07:19:03 GMT

A：I have a stand-alone Splunk Enterprise,This includes search, indexing。
B：Now,I built a Splunk cluster，The Splunk cluster includes (three search servers, three index servers, one deployment server, multiple universal forwarders).

question：

 How to migrate stand-alone version of the Splunk index and the field to the cluster (search  servers)

Also: Is there a talk about Splunk's technical group? May i join?

Re: How to migrate indexes and fields

skoelpin — Mon, 17 Apr 2017 11:05:45 GMT

How many concurrent searches do you have? I would suggest making an index cluster first then move to a search head cluster when you have more users searching.

First step would be to create the master node instance, then create your indexers, then search heads. You should join each instance to the license pool and setup your DS and forwarders.

I think you will need to manually add the data to your clustered indexers since old data will not populate onto the new nodes

Here's a link discussing rebalancing data along the nodes

http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Rebalancethecluster

You should also look into joining the Splunk Slack channel

Re: How to migrate indexes and fields

jkat54 — Mon, 17 Apr 2017 11:09:00 GMT

First you'll want a firm understanding of index time versus search time field extractions and transformations by reading over the props.conf and transforms.conf documentation.

Then you can pretty much just follow these articles:

http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Migratenon-clusteredindexerstoaclusteredenvironment

http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/Migratefromstandalonesearchheads

You'll note they say contact splunk PS for migrating the data. It can be easier to just leave the old standalone indexer up and running and use it as a search peer on the new SHC. Migrating the data requires a bit of scripting to attach the cluster guid to the bucket file names, and also needs to take into consideration the possibility of bucket collisions and other posibillities... Which is why they recommend contacting PS if it's absolutely necessary.

Re: How to migrate indexes and fields

jkat54 — Thu, 20 Apr 2017 10:31:17 GMT

What do you mean about joining Splunks technical group?

There is a slack channel and an irc channel open to the public.