I'm closing down one a Splunk 'test' instance we have on a Windows virtual machine and bringing up a distributed Linux hardware environment w/ 3 Indexers and a single search head. I'm wondering if it would be best to try and migrate/import the data from the VM to one of the Linux Indexers or if it would make more sense to turn the VM into a search peer for the search head? The new Indexers have no data on them as of yet.
Long term having to maintain the single windows instance on VM just to keep alive the amount of data collected during the testing phase doesn't seem to make so much sense. I would recommend migrating the data into the new architecture to simplify your deployment. Hope that helps.
I agreee, but how important is the data on your Windows server? I would concider dumping it or moving the indices over. If you have access to the orginal log data, just reindex it so that its distruted.
If you recreate the indexes locations on the new indexers, you can simply copy the old buckets in the correct folders. (and even spread them over several indexers)
example : for the main index the buckets are the subfoldersin $SPLUNK_HOME/var/lib/splunk/defaultdb/db
and if you already have existing buckets in the destination, make sure to avoid bucket id duplicates (you can increment them manually)
example : in db1345573209134557320910 the bucketid is 10, in hotv15 the bucket_id is 5
in case of bucket_id collision, here is the behavior : http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled