How to migrate Data from One SHC to a new SHC (Including ITSI Correlation Search)?

[JohnWilly]

We have an SHC cluster on enterprise Version 7.3.5 & ITSI 4.4. Recently we trigged to upgrade our ITSI from 4.4.X to 4.7.0 and it failed.

It was an generic error message and support was not able to find the root cause.

So we are now trying to build a new SHC in parallel (Same Version as Original one) and connect it to the same Indexer cluster. We want to make sure original cluster is working fine until we are sure that new SHC is an exact replica.

1] Is there an issue having new different SHC connected to a same index cluster?

2] How do we migrate all the data from one SHC to another including the ITSI correlation Search , Dashboards, Lookup table, Entities etc.

3] Upon Migration can we upgrade ITSI to 4.7 and above  on new SHC?

[scelikok]

Hi @JohnWilly,

Actually, I didn't use backup/restore for ITSI but it should work if Splunk and ITSI versions are the same on the destination. 

[scelikok]

Hi @JohnWilly,

1- Since ITSI is using a lot of data models adding a new SHC to the indexer cluster will cause duplicate acceleration tsidx files. This will put an extra load into the system for CPU, I/O and storage space. That's why I would not do it.

2- You can use full backup/restore procedure.  Create a full backup of ITSI

3- Since Splunk Enterprise 7.3.5 supports ITSI 4.7 you should be able to upgrade. But because of backup/restore you may have the same upgrade problem.

My advice is upgrade Splunk Enterprise and ITSI to a supported version.

[JohnWilly]

Hi @scelikok 

Thank you for responding.

Regarding the backup restore option. When we tried to take backup from one SHC and restore on another it was giving some error. Is there any restrictions?