Deployment Architecture
Highlighted

Migrating ITSI from shared search head to dedicated search head?

Explorer

I'm looking to migrate ITSI 2.4 (IT Service Intelligence), which is on a shared, clustered set of search heads (SH)'s, to a dedicated SH running ITSI 2.6.

Is there a guide or how-to on how this might be accomplished? What sort of directories and configuration information should be moved/copied to the new location?

Thank you.

0 Karma
Highlighted

Re: Migrating ITSI from shared search head to dedicated search head?

SplunkTrust
SplunkTrust

I believe Backup and Restore option would work for you. See this for more information: https://docs.splunk.com/Documentation/ITSI/2.6.1/Configure/BackupandRestoreITSIconfig

0 Karma
Highlighted

Re: Migrating ITSI from shared search head to dedicated search head?

SplunkTrust
SplunkTrust

ITSI uses the kv-store to maintain its data. You can run a simple backup and apply it to your dedicated search head ( I did this exact same thing last week)

To test it, you can take the backup, restore the backup on your new search head and verify your services and KPI's are populating correctly. This assumes your dedicated SH is searching the same indexers as your shared SH.

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.