Is it possible to create new indexer cluster and join it with old cluster to migrate old data from old to new cluster?

[saurabh0912]

Hi,

Wanted to know if its possible to create new  indexer cluster and add it as peers to the existing cluster to copy all the old buckets on new set of indexes and segregate it once all the old data is available on new one ?

[isoutamo]

Hi

here is my old answer for migrating clustered environment to new hardware. https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platf...
it starts with migrate CM and cluster peers and then same for SHC part.

Basically just extended cluster with new peers, migrate old peers to new ones and finally remove old peers. You could replace also CM if needed, but it’s not mandatory.

r. Ismo

[gcusello]

Hi @saurabh0912,

you could add some search peers to an Indexer Cluster and then remove, one by one the old members.

But you cannot change the indexes.

It isn't so clear for me the purpose of your requirement.

Ciao.

Giuseppe

[saurabh0912]

Thanks @gcusello ,

Our intention is to create new splunk envrionment , while keeping the splunk alive for some time in old environment.

I was thinking of creating a large cluster, having indexes on both sides, and let splunk copy the entire data from old indexes to the new indexes and once cutover times comes, disconnect the old indexers and create new cluster master on new cloud envrionment, is it possible? 

[gcusello]

Hi @saurabh0912,

Yes, it's possible.

You have to add the new search peers following the instructions at https://docs.splunk.com/Documentation/Splunk/9.1.0/Indexer/Addclusterpeer#:~:text=You%20can%20add%20....

and then replase the Master Node following the instructions at https://docs.splunk.com/Documentation/Splunk/9.1.0/Indexer/Handlemanagernodefailure

Before starting this activities, I hint to engage a Splunk Architect for a complete design of the new infrastructure an planning of the activities.

Ciao.

Giuseppe