Deployment Architecture

How to migrate Splunk Heavy Forwarder to a new server?

lucas4394
Path Finder

Hi all, how to migrate Splunk Heavy Forwarder to a new server?  

Thanks.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

remember that you must copy splunk.secret before you start HF first time. 
Otherwise your plan should work. If there are some other apps with different versions I would like to start with current version and then update it. Of course there are some exceptions for that. And remember shutdown those apps/inputs before you copy data and checkpoints to the new HF otherwise there will be duplicate events. 
r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

is it mandatory to migrate it or just add new one and remove old when the new is in the use?

r. Ismo

0 Karma

lucas4394
Path Finder

Hi @isoutamo , thank you for your quick response.  We are going to retire the old servers and it is mandatory to migrate the Heavy Forwarder to the new servers.  My major concern is there are lots of apps with module inputs, api call, dbconnect, etc. with encrypted password or security keys on the HF, and last checkpoints are might be stored some common folders, etc.  What is the best way to handle them?  Thanks.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you do rpm installations and then rsync data’s and applications from here old one or do you need to update versions at the same time or later?

r. Ismo

0 Karma

lucas4394
Path Finder

Hi @isoutamo , my initial plan was to install the new version of Splunk on the new server, then migrate apps by apps to the new one, but  I don't have confidence for my approach due to encrypted password and last checkpoint from the apps.

0 Karma

ChrisH
Explorer

Copying the splunk.secret from the old heavy forwarder to the new one should help with the passwords.

isoutamo
SplunkTrust
SplunkTrust

Hi

remember that you must copy splunk.secret before you start HF first time. 
Otherwise your plan should work. If there are some other apps with different versions I would like to start with current version and then update it. Of course there are some exceptions for that. And remember shutdown those apps/inputs before you copy data and checkpoints to the new HF otherwise there will be duplicate events. 
r. Ismo

lucas4394
Path Finder

thanks.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...