Deployment Architecture

How to move the SHC - deployer to another host? (Part 2)

Glasses2
Communicator

So I need to move a deployer to a dedicated host.

I have a 3 member shc on version 8.1.3, all healthy.

I have read a number of posts that give similar answers (to the answer I received for my original post),

such as >

"copy over the /opt/splunk/etc/shcluster to the new deployer"

"configure the new deployer (to use the cluster's secret key and to set the SHC label), move the configuration bundle from the old deployer to the new deployer, and then point the cluster members to the new deployer"

"migrate the shcluster folder structure and any shclustering stanza configurations you have on the deployer to the new deployer"

" also break the SHC and rebuild with new deployer info"

 

While all these answers make sense, IDK exactly know what to reconfigure/change so I read > https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/BackuprestoreSHC

And that takes you down the rabbit hole of backups and restores that don't entirely seem necessary, so I am wondering if anyone can verify the minimum changes that need to be made? OR if I should follow the above link's instructions.

 

As I understand it, I just need to do the following>>>

1) Build new Deployer ( new IP, new FQDN), install Splunk...

2) configure with the [shclustering] stanza in /opt/splunk/etc/system/local  server.conf

[shclustering]

pass4SymmKey =<secret>

shcluster_label = <name>

3) on each SHC member,  edit the [shclustering] stanza

[shclustering]
conf_deploy_fetch_url = https://<newIP>:8089

make sure "pass4SymmKey" and "shcluster_label" is same as on new Deployer

4) copy over the /opt/splunk/etc/shcluster to the new deployer

5) Restart everything 

Does that seem right?  I don't have the luxury of a dev environment to test... 

Do I need to put shc members in detention or stop splunk on everything before I make the changes?

Any advice is appreciated.

Thank you

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Those steps look OK to me.  There's no need for detention or to stop everything first.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Those steps look OK to me.  There's no need for detention or to stop everything first.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...