Deployment Architecture

How to split data from old indexer to new indexers.

brent89567
New Member

I have a setup right now where we have 1 indexer in our test environment and we are putting 2 new indexers in the production environment. I need to know if I move all the data from the old indexer and split it evenly between the new indexers, will I run into any errors on the two indexers?

0 Karma

gcusello
Legend

Hi @ brent89567,
you should share more infos:

  • the new indexers are clustered or not?
  • if not clustered do you want that both the indexers receive all the logs or some indexes will be in Indexers1 and some others in Indexers2?

Anyway, if you have clustered indexers, it isn't possible to replicate old data, so old data can be copied in one indexers (in a different index) and the new data will be replicated between both of them; steps are:

  • stop all indexers,
  • copy indexes from old Indexers to one of the new ones using a different name (e.g. my_index will be my_old_index),
  • restart Splunk in the new Indexers,
  • put indexes.conf in master Node and push the configuration,
  • change all your searches to search in both the indexes (index=my_index OR index=my_old_index), a good idea is to use eventtypes in your searches so you have to change only the eventtype,
  • move addressing in Universal Forwarders to send logs to the new Indexers.

If instead you want to use stand-alone Indexers, you have to:

  • stop Splunk in all the three servers,
  • copy Indexes in one Indexer (eventually some indexes in Indexer1 ans some others in Indexer2),
  • copy indexes.conf in both the new Indexers,
  • restart the new Indexers,
  • move addressing in Universal Forwarders to send logs to the new Indexers.

Ciao.
Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

More information is needed.
Do you need to move the test data to production?
Are the indexers clustered in test or prod?
How much data is there?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...