Deployment Architecture

Search Head - migrating apps, views and users from indexer

Path Finder

I'm going from a single server installation to a Search Head + Indexer setup.

I've managed to install and setup the Search Head but now I would like to migrate everything (except the indexes) to the search head, that is:

  • Users, Roles and Authentication config
  • Apps, Searches, Reports and Views
  • Macros, Extracted Fields and Lookups

Basically, the only thing that stays in the original server is the actual indexes (and indexes.conf of course) since the plan is to have users use JUST the Search Head.

All the documentation talks about is the knowledge bundle but, at this moment, all the "knowledge" is in the indexer...

It seems that I should copy (almost) the entire(?) $SPLUNK_HOME/etc to the search head but I can't find anything on the documentation about this.

0 Karma


What I would do:

User, roles, authentication:
- Copy $SPLUNK_HOME/etc/passwd (your user-password-roles pair)
- Copy authorize.conf from $SPLUNK_HOME/etc/system/local/ (your roles definition)

App/searches/Views. Locate your apps on $SPLUNK_HOME/etc/apps/
If you do everything in "search" app, don't copy the search app folder completely as it might give you headache later on when you upgrade. I'll do the following inside of the search app:
- copy your "local" folder (it has your searches, views, macros, lookups)
- copy metadata/local.meta if you want to preserve who owns what searches (it's not important)

For other apps that you have created from barebone template, you can simply copy over the whole app folder.

This works well in my experience.


Build all your configs, Macros, Field Extractions and lookups into apps like SearchHead_App, Indexer_app, Athentication_app. Then use Deployment Server

0 Karma


Copying the entire etc folder to the new instance would probably work (in my experience) although you may run into issues depending on what kind of config changes you have made. If i were you i would install fresh on each server, and copy the etc/apps directory to the Search Head, most apps shouldn't be necessary on the indexer (correct me if im wrong). And then copy /etc/system/local to both the indexer and search head. You will have to do some manual changes on these configs as each server has different roles, one searching, one just indexing.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...