Deployment Architecture

How to move the SHC - deployer to another host? (Part 2)

Glasses2
Communicator

So I need to move a deployer to a dedicated host.

I have a 3 member shc on version 8.1.3, all healthy.

I have read a number of posts that give similar answers (to the answer I received for my original post),

such as >

"copy over the /opt/splunk/etc/shcluster to the new deployer"

"configure the new deployer (to use the cluster's secret key and to set the SHC label), move the configuration bundle from the old deployer to the new deployer, and then point the cluster members to the new deployer"

"migrate the shcluster folder structure and any shclustering stanza configurations you have on the deployer to the new deployer"

" also break the SHC and rebuild with new deployer info"

 

While all these answers make sense, IDK exactly know what to reconfigure/change so I read > https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/BackuprestoreSHC

And that takes you down the rabbit hole of backups and restores that don't entirely seem necessary, so I am wondering if anyone can verify the minimum changes that need to be made? OR if I should follow the above link's instructions.

 

As I understand it, I just need to do the following>>>

1) Build new Deployer ( new IP, new FQDN), install Splunk...

2) configure with the [shclustering] stanza in /opt/splunk/etc/system/local  server.conf

[shclustering]

pass4SymmKey =<secret>

shcluster_label = <name>

3) on each SHC member,  edit the [shclustering] stanza

[shclustering]
conf_deploy_fetch_url = https://<newIP>:8089

make sure "pass4SymmKey" and "shcluster_label" is same as on new Deployer

4) copy over the /opt/splunk/etc/shcluster to the new deployer

5) Restart everything 

Does that seem right?  I don't have the luxury of a dev environment to test... 

Do I need to put shc members in detention or stop splunk on everything before I make the changes?

Any advice is appreciated.

Thank you

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Those steps look OK to me.  There's no need for detention or to stop everything first.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Those steps look OK to me.  There's no need for detention or to stop everything first.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...