Deployment Architecture

Need advice on consolidating Search heads ( USERS, Searches, Apps, etc )

Log_wrangler
Builder

I thought I would get some expert advice before manually moving Users Searches Dashboards from one SH to another.

I would like to automagically move Users, etc from one SH to another.

The Moving SH is v 6.3.1 to Destination SH is v 6.6.4, not sure how that will affect the outcome.

Also this is not a SH cluster setup (on the Destination SH) and not predicted to become a SH cluster situation.

Any advice appreciated. Thank you!

Tags (2)
0 Karma

damiensurat
Contributor

I would simply install the older version of Splunk on the new server, copy over the entire Splunk directory to the new server and then perform an in place upgrade.

elliotproebstel
Champion

Yes to this. But also be aware that you'll need to do some additional work to manually migrate any kvstores.

0 Karma

Log_wrangler
Builder

Thank you for your reply.

I like your suggestion, however the I need to retain reports, alerts, etc on the 6.3.1 instance which are not on the 6.6.4.

The goal was to upgrade 6.3.1 to 6.6.4 and then move everything to the original 6.6.4 search head.

Please advise if you are still monitoring this question.

Thank you

0 Karma

adonio
Ultra Champion

hello @Log_wrangler,

i think there are couple of ways to go about it, but here is how i will do it, as i will try and use this opportunity to check which user cares about her searches.
1. make sure all the saved searches / dashboards / reports / alerts are within app level permissions
2. grab all the savedsearches.conf files from all the apps and create a single savedsearches.conf file
3. take all the .xml files from all apps, path $SPLUNK_HOME/etc/apps/<some_app>/<default_or_local>/data/ui/views and place them together in a temp folder (make sure there arent any naming conflicts).
4. create a new app and name it "migration" or something of that notion.
5. place all .xml files in the same created path in the new app
6. place savedsearches.conf in the new app
7. move the app to new search head

couple of other points:
1. might need to move other configurations that the searches depends upon like: props.conf, lookups, other items
2. make sure the new app has global permission
3. let everyone know where their "stuff" is now
4. if needed, help users migrate their items to new apps on new search head

hope it helps

0 Karma

Log_wrangler
Builder

Thank you for your reply.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...