Hi,
I've been informed that my existing search-head deployer and cluster master (two different servers) need to get moved to new servers. I can't find any doc on how to do this procedure. Has anyone done it?
To replace the deployer, it should not be necessary to grab the runtime config from a cluster member, as the previous respondent was recommending. That is, unless you are also replacing the cluster members, but that does not seem to be your need.
Rather, you merely need to configure the new deployer (to use the cluster's secret key and to set the SHC label), move the configuration bundle from the old deployer to the new deployer, and then point the cluster members to the new deployer.
The configuration steps are outlined here: http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/PropagateSHCconfigurationchanges#Config...
Oh nice! So is it correct that if you change the Deployer the Members won't act like "woah, who dis?! lemme just dump everything I got and start fresh with this new cool deployer dude?!" (in my world, the SH members are clearly surfers).
The steps you can use to migrate deployer is this (same as replacing deployer when original one had failure)
Looks like it's [at least partially] documented:
In regards to a SHC, I don't see anything explicit about changing hosts. Given that the Deployer will essentially replace what's on the SHC apps I would suggest approaching the Deployer as if you were building out the SHC from scratch - except you can grab the runtime config from one of the search heads to act as the new deployer's config.
Some additional tips: