Splunk Dev

Migrate Index without shutdown

mdmurtazaali
New Member

Hi There, We have two indexer (not clustered) but on DNS roundrobin. We need to migrate the indexers to the new hardware and we are planning to do that one by one. For indexer 1 Is there any way to:
1. Copy the files to the new server without shutting down splunk?
2. Can the indexer 1 be readonly from search head?

Thanks,

Mo

Tags (1)
0 Karma
1 Solution

jcrabb_splunk
Splunk Employee
Splunk Employee

Here is our documentation that discusses migrating:

http://docs.splunk.com/Documentation/Splunk/6.5.2/Installation/MigrateaSplunkinstance

As you will see in this section, you will need to stop Splunk:

1. Stop Splunk Enterprise on the host from which you want to migrate.
2. Copy the entire contents of the $SPLUNK_HOME directory from the old host to the new host.
3. Install the appropriate version of Splunk Enterprise for the target platform.
4. Confirm that index configuration files (indexes.conf) contain the correct location and path specification for any non-default indexes.
5. Start Splunk Enterprise on the new instance.
6. Log into Splunk Enterprise with your existing credentials.
7. After you log in, confirm that your data is intact by searching it.

While you can make an index read-only, in order to migrate properly, you will need to stop Splunk.

Jacob
Sr. Technical Support Engineer

View solution in original post

puneethgowda
Communicator

Answer for your question is downtime is must

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

Here is our documentation that discusses migrating:

http://docs.splunk.com/Documentation/Splunk/6.5.2/Installation/MigrateaSplunkinstance

As you will see in this section, you will need to stop Splunk:

1. Stop Splunk Enterprise on the host from which you want to migrate.
2. Copy the entire contents of the $SPLUNK_HOME directory from the old host to the new host.
3. Install the appropriate version of Splunk Enterprise for the target platform.
4. Confirm that index configuration files (indexes.conf) contain the correct location and path specification for any non-default indexes.
5. Start Splunk Enterprise on the new instance.
6. Log into Splunk Enterprise with your existing credentials.
7. After you log in, confirm that your data is intact by searching it.

While you can make an index read-only, in order to migrate properly, you will need to stop Splunk.

Jacob
Sr. Technical Support Engineer

mdmurtazaali
New Member

Thanks @Jcrabb!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...