How to migrate Splunk Heavy Forwarder to a new server?

[lucas4394]

Hi all, how to migrate Splunk Heavy Forwarder to a new server?  

Thanks.

[isoutamo]

Hi

is it mandatory to migrate it or just add new one and remove old when the new is in the use?

r. Ismo

[lucas4394]

Hi @isoutamo , thank you for your quick response.  We are going to retire the old servers and it is mandatory to migrate the Heavy Forwarder to the new servers.  My major concern is there are lots of apps with module inputs, api call, dbconnect, etc. with encrypted password or security keys on the HF, and last checkpoints are might be stored some common folders, etc.  What is the best way to handle them?  Thanks.

[isoutamo]

Can you do rpm installations and then rsync data’s and applications from here old one or do you need to update versions at the same time or later?

r. Ismo

[lucas4394]

Hi @isoutamo , my initial plan was to install the new version of Splunk on the new server, then migrate apps by apps to the new one, but  I don't have confidence for my approach due to encrypted password and last checkpoint from the apps.

[ChrisH]

Copying the splunk.secret from the old heavy forwarder to the new one should help with the passwords.

[isoutamo · Accepted solution]

Hi

remember that you must copy splunk.secret before you start HF first time. 
Otherwise your plan should work. If there are some other apps with different versions I would like to start with current version and then update it. Of course there are some exceptions for that. And remember shutdown those apps/inputs before you copy data and checkpoints to the new HF otherwise there will be duplicate events. 
r. Ismo

[lucas4394]

thanks.