Deployment Architecture

How to move the SHC - deployer to another host? (Part 2)

Glasses2
Communicator

So I need to move a deployer to a dedicated host.

I have a 3 member shc on version 8.1.3, all healthy.

I have read a number of posts that give similar answers (to the answer I received for my original post),

such as >

"copy over the /opt/splunk/etc/shcluster to the new deployer"

"configure the new deployer (to use the cluster's secret key and to set the SHC label), move the configuration bundle from the old deployer to the new deployer, and then point the cluster members to the new deployer"

"migrate the shcluster folder structure and any shclustering stanza configurations you have on the deployer to the new deployer"

" also break the SHC and rebuild with new deployer info"

 

While all these answers make sense, IDK exactly know what to reconfigure/change so I read > https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/BackuprestoreSHC

And that takes you down the rabbit hole of backups and restores that don't entirely seem necessary, so I am wondering if anyone can verify the minimum changes that need to be made? OR if I should follow the above link's instructions.

 

As I understand it, I just need to do the following>>>

1) Build new Deployer ( new IP, new FQDN), install Splunk...

2) configure with the [shclustering] stanza in /opt/splunk/etc/system/local  server.conf

[shclustering]

pass4SymmKey =<secret>

shcluster_label = <name>

3) on each SHC member,  edit the [shclustering] stanza

[shclustering]
conf_deploy_fetch_url = https://<newIP>:8089

make sure "pass4SymmKey" and "shcluster_label" is same as on new Deployer

4) copy over the /opt/splunk/etc/shcluster to the new deployer

5) Restart everything 

Does that seem right?  I don't have the luxury of a dev environment to test... 

Do I need to put shc members in detention or stop splunk on everything before I make the changes?

Any advice is appreciated.

Thank you

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Those steps look OK to me.  There's no need for detention or to stop everything first.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Those steps look OK to me.  There's no need for detention or to stop everything first.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...