When old indexer servers in an indexer cluster are moved to new servers, what is the best way to move disk or data?

[koshyk]

Situation: Indexer cluster, dual site, replication factor=2

We have some old indexer servers to be moved to new servers. The disk is going to be the same and reused.

1. Can we just move the disk to new server if the hostname is mapped to old indexer?
2. In indexer cluster, there is the GUID of machine in the bucket name. Will this be an issue?
3. Will there be an issue with replicated buckets (rb) ?

[Masa · Accepted solution]

In a way, you can do it.

If you're not going to use the old server, I recommend to copy all the $SPLUNK_HOME contents to the new server.
or, try to use the same host name, site and GUID (instance.cfg) for the new instance.

[koshyk]

"instance.cfg" just didn't work as it had lot of issues.
Atlast went with whole copy of $SPLUNK_HOME which went smooth

[koshyk]

thanks @Masa for pointing out "instance.cfg".
Will a direct copy of "$SPLUNK_HOME" work? or do i need to clear _raft etc?

[aaraneta_splunk]

@koshyk - Did Masa's answer help to provide a solution to your question? If yes, please don't forget to click "Accept" below the answer to resolve this post. Thanks!

[Masa]

A direct copy of "$SPLUNK_HOME" should work. I still recommend you to test it in a small test environment.