I wanted to reach out to the community for some assistance/clarification on the best approach to change a search head with 2 index peers to a new windows server?
We currently have one search head acting as the license master with two index peers that it is connected to. The search head server is being decommissioned so I will need to swap out the search head and license master to the new server.
Is there a recommended best approach to this?
I found the following information:
When you migrate on *nix systems, you can extract the tar file you downloaded directly over the copied files on the new system, or use your package manager to upgrade using the downloaded package. On Windows systems, the installer updates the Splunk files automatically.
But this seems a little to simple.
I am unable to keep the same server name and IP address that the search head has now.
So that got me thinking this maybe simple but I just wanted to ensure I am not missing a critical step.
I agree with @richgalloway .
Only one additional information: if you're using Windows, don't copy the entire $SPLUNK_HOME folder, but install the same Splunk version on the new machine (with a different hostname and ip address).
then you can follow the procedure, but copying only $SPLUNK_HOME\etc folder (not the entire $SPLUNK_HOME folder), where Splunk stores all its configurations.
On Linux you can copy the entire folder, but on Windows it isn't sufficient.
Then at the end, you have to change the License master Addressing on your Indexers, so summarizing: