Best Practices Migrating from shared search heads to a search head cluster?

[lisaac]

I have 5-7 shared search heads that are not synced with configuration items. I am migrating all search heads to a shared search head cluster. Does anyone have any best practices or recommendations on how to best consolidate 5-7 shared search heads into a new SH cluster? At this point, we are looking to migrate user created apps and public artifacts.

[Raghav2384]

Adding to what muebel said, please read migrating search app twice if not more.....That's is going to tricky and please check the app.conf thoroughly after you consolidate all of the artifacts on Deployer before you push. Might take a lot of time to consolidate initially but will save you from this hassle on a long run 🙂

Thanks,
Raghav

[muebel]

HI lisaac, you'll find some good information in Splunk's Docs here : http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/Migratefromstandalonesearchheads

Essentially, it's a matter of sorting out and potentially merging together the various apps from the separate searchheads, and then transferring the collected configuration to the newly created Searchhead Cluster.

Please let me know if this answers your question 😄