I am planning to migrate from an all-in-one Splunk instance to a Splunk cluster. I am thinking about turning the old all-in-one Splunk instance into a search head in the cluster.
So my idea is that the new servers for the cluster will start indexing/replicating any data after the cut and have legacy data in the search head.
Would this give me access to the legacy data? Any issues that I am not thinking about.
In the future, I recommend adding such a comment as a comment as it does not really address the question. However, it is informative. Any idea how to make the question appear as not answered?
I am confused. You can downvote my answer all you want, but see the section http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Migratenon-clusteredindexerstoaclustereden.... You don't have to like the answer, but contacting professional services is your best bet.
Well, I am not trying to migrate my legacy data and I understand the issues with doing that. I want the legacy data to be there while using my legacy instance as a search head instead of a search peer.
Okay, apologies for misunderstanding. The migration topic does recommend converting your indexer into a search peer rather than a search head--then you'll definitely have access to your legacy data. I don't know if it would work to do it the way you're asking about. Is there a specific reason you want to take this other approach?
I have new hardware for the indexers that has higher IOPS. I want to use the new hardware to cluster indexing. However, I want to have the old data available, but I do not want the old hardware to be indexing new data.