Deployment Architecture

How do I properly migrate from a single search head to another single search head?

I have a single search head, so I want to migrate the data to another single search head. I have done this much process till now.

Steps:-
1. Stop Splunk on both instances.
2. Types of objects to migrate
- copy etc/apps folder from the old search head to the new search head.
- copy etc/users private user configuration from the old search head to the new search head
3. Restart the new search head.

Can I run the servers in tandem and slowly cut over while migrating?

0 Karma
1 Solution

Esteemed Legend

Yes, there is no reason not to run the servers in tandem and slowly cut over while migrating. What you have done right now is not a full migration because you did not move your indexed data (typically in $SPLUNK_HOME/var/lib/...). You have essentially created a new search head and made your existing All-in-one an Indexer. If you do not need to get rid of the old server, this is a good configuration. Go to Settings -> Distributed search -> Add Search Peer and connect your old server (now Indexer) to your new Search Head.

View solution in original post

Esteemed Legend

Yes, there is no reason not to run the servers in tandem and slowly cut over while migrating. What you have done right now is not a full migration because you did not move your indexed data (typically in $SPLUNK_HOME/var/lib/...). You have essentially created a new search head and made your existing All-in-one an Indexer. If you do not need to get rid of the old server, this is a good configuration. Go to Settings -> Distributed search -> Add Search Peer and connect your old server (now Indexer) to your new Search Head.

View solution in original post

SplunkTrust
SplunkTrust

There is good documentation here: https://docs.splunk.com/Documentation/Splunk/7.2.3/Installation/MigrateaSplunkinstance (specifically at the bottom).

Typically I do this:

  1. Install splunk in new location
  2. stop splunk in old location
  3. copy entire etc and var directories into the new location with exact same paths
  4. start new environment

You will also need to consider how you get users to the new location and how to get data to the new location.

Yes you can leave both running at once.

Good luck!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!