Steps to Migrate Splunk Enterprise (All-in-One) Instance to a New Splunk Enterprise Cluster

[rayleigh29]

Hi everyone,

I’m currently planning to migrate an existing Splunk Enterprise All-in-One instance (Search Head + Indexer + License Master + Deployment Server in a single node) that also runs Splunk Enterprise Security (ES) into a new Splunk Clustered Architecture, which will include:

• 1x Cluster Manager
• 3x Indexers
• 1x Search Head Cluster (3x SH + 1x Deployer)
• 1x License Master / Deployment Server
• 2x Heavy Forwarder

The plan is to keep the old All-in-One instance available for historical searches only during the transition, and eventually decommission (recycle) it once all data and workloads have been fully migrated.
Additionally, I’m planning to upgrade to the latest versions — Splunk Enterprise v10.x and Splunk Enterprise Security v8.2, if supported and compatible during migration. (Current Version are Splunk Enterprise v9.0.3 and Splunk ES v7.1.0)

Specifically:

• What is the best approach to migrate existing data (apps, add-on, etc), ES configurations, and correlation searches from the All-in-One instance to the new clustered environment?
• Should I first build the cluster (with ES installed on the SHC) and then migrate data/configurations, or can I reuse parts of the old ES setup directly?
• What’s the recommended way to integrate the old instance for historical search access during the migration period?
• What’s the recommended way to handle the UF data sources — e.g., when and how to repoint them to the new Heavy Forwarder?

Appreciate any insight, recommendation on what is the better way do to this.

Thank you in advance!

[richgalloway]

Why do you want heavy forwarders?  It's usually better to have the UFs send directly to the indexers.

ES should run on its own search head, unless it's busy enough to need a SHC.  If so, you should have a separate SHC for adhoc searches and other non-ES uses.

I would create new instances from scratch (this is required for an SHC) and keep the standalone SH for historical searches using Federated Search.  As you create the instances, copy their settings from the AIO instance.

You'll probably find you'll need to refactor your apps when you copy them from the AIO to the clusters.  There will be settings needed by indexers and not by SHs and vice-versa.

UFs can be repointed to the new indexers as soon as the new environment is ready for use.

For details about migrating to a SHC, see
https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/deploy-search-head-cl...

Similar concepts apply to migrating an AIO instance to an indexer cluster.