Splunk Migration: From ESXI to Hyper-V

[0xAli]

Hi,

We want to migrate from the ESXI VM to the Hyper-V:

Our Initial approach:

Fresh OS + Splunk installations on Hyper-V, then migrate Splunk configurations from the existing environment.

Migrate 5 Splunk VMs:

• Universal Forwarder 01
• Universal Forwarder 02
• Heavy Forwarder 01
• Cluster Master
• Deployment Serve

what is the best practice or recommendation for that migration.

[livehybrid]

Hi @0xAli 

Are you maintaining the same IP/hostname configuration on HyperV? This might make a big difference.

The Cluster Manager is pretty stateless so apart from copying over the manager-apps there shouldnt be too much to do. The Deployment Server is obviously going to need to be in place before the forwarders are brought online but for me the thing you will need to make sure is that the forwarders have all the relevant configs they need *before* they are accessible from their clients, otherwise they might receive data and not process it correctly.  I guess the easiest way to do this is make sure the inputs.conf configuration is distributed from the DS, therefore it wont be listening until its downloaded its apps from the DS and updated etc.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing