How to migrate standalone Enterprise Security search head to new ES search head cluster?

[erw550]

Hi,

Today we have a standalone enterprise security (ES) search head which we would like to migrate to a new ES search head cluster (and keep all the knowledge objects). Is there instructions on how to turn a standalone ES search head into a ES search head cluster?

Thanks,

Sebastian

[richgalloway]

Standalone search heads cannot be made into a cluster.  The steps for creating a SHC specifically call for *brand new* SH instances.  

Once you've created the cluster using at least three new SHs, copy the ES KOs to the SHC deployer (which can be the existing SH) and push them to the cluster.