How do I properly migrate from a single search head to another single search head?

[rajpingale123]

I have a single search head, so I want to migrate the data to another single search head. I have done this much process till now.

Steps:-
1. Stop Splunk on both instances.
2. Types of objects to migrate
- copy etc/apps folder from the old search head to the new search head.
- copy etc/users private user configuration from the old search head to the new search head
3. Restart the new search head.

Can I run the servers in tandem and slowly cut over while migrating?

[woodcock · Accepted solution]

Yes, there is no reason not to run the servers in tandem and slowly cut over while migrating. What you have done right now is not a full migration because you did not move your indexed data (typically in $SPLUNK_HOME/var/lib/...). You have essentially created a new search head and made your existing All-in-one an Indexer. If you do not need to get rid of the old server, this is a good configuration. Go to Settings -> Distributed search -> Add Search Peer and connect your old server (now Indexer) to your new Search Head.

[chrisyounger]

There is good documentation here: https://docs.splunk.com/Documentation/Splunk/7.2.3/Installation/MigrateaSplunkinstance (specifically at the bottom).

Typically I do this:

1. Install splunk in new location
2. stop splunk in old location
3. copy entire etc and var directories into the new location with exact same paths
4. start new environment

You will also need to consider how you get users to the new location and how to get data to the new location.

Yes you can leave both running at once.

Good luck!