Deployment Architecture

Best Practices Migrating from shared search heads to a search head cluster?

lisaac
Path Finder

I have 5-7 shared search heads that are not synced with configuration items. I am migrating all search heads to a shared search head cluster. Does anyone have any best practices or recommendations on how to best consolidate 5-7 shared search heads into a new SH cluster? At this point, we are looking to migrate user created apps and public artifacts.

0 Karma

Raghav2384
Motivator

Adding to what muebel said, please read migrating search app twice if not more.....That's is going to tricky and please check the app.conf thoroughly after you consolidate all of the artifacts on Deployer before you push. Might take a lot of time to consolidate initially but will save you from this hassle on a long run 🙂

Thanks,
Raghav

0 Karma

muebel
SplunkTrust
SplunkTrust

HI lisaac, you'll find some good information in Splunk's Docs here : http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/Migratefromstandalonesearchheads

Essentially, it's a matter of sorting out and potentially merging together the various apps from the separate searchheads, and then transferring the collected configuration to the newly created Searchhead Cluster.

Please let me know if this answers your question 😄

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...