Deployment Architecture
Highlighted

Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Communicator

I am planning to migrate from an all-in-one Splunk instance to a Splunk cluster. I am thinking about turning the old all-in-one Splunk instance into a search head in the cluster.

So my idea is that the new servers for the cluster will start indexing/replicating any data after the cut and have legacy data in the search head.

Would this give me access to the legacy data? Any issues that I am not thinking about.

Tags (1)
Highlighted

Re: Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Champion

Do you want to keep only selective data or all data?

0 Karma
Highlighted

Re: Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Communicator

I want to keep all the legacy data.

0 Karma
Highlighted

Re: Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Splunk Employee
Splunk Employee

If you have not already done so, you should definitely read Migrate non-clustered indexers to a clustered environment in the Managing Indexers and Clusters manual.

Highlighted

Re: Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Communicator

Thanks for the link. Unfortunately, they do not address the topic on that link.

0 Karma
Highlighted

Re: Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Communicator

In the future, I recommend adding such a comment as a comment as it does not really address the question. However, it is informative. Any idea how to make the question appear as not answered?

0 Karma
Highlighted

Re: Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Splunk Employee
Splunk Employee

I am confused. You can downvote my answer all you want, but see the section http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Migratenon-clusteredindexerstoaclustereden.... You don't have to like the answer, but contacting professional services is your best bet.

0 Karma
Highlighted

Re: Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Communicator

Well, I am not trying to migrate my legacy data and I understand the issues with doing that. I want the legacy data to be there while using my legacy instance as a search head instead of a search peer.

0 Karma
Highlighted

Re: Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Splunk Employee
Splunk Employee

Okay, apologies for misunderstanding. The migration topic does recommend converting your indexer into a search peer rather than a search head--then you'll definitely have access to your legacy data. I don't know if it would work to do it the way you're asking about. Is there a specific reason you want to take this other approach?

0 Karma
Highlighted

Re: Splunk Cluster Migration - keep legacy data searchable on non-clustered instance

Communicator

I have new hardware for the indexers that has higher IOPS. I want to use the new hardware to cluster indexing. However, I want to have the old data available, but I do not want the old hardware to be indexing new data.