Getting Data In

Best practices when migrating a Windows search head to new physical hardware in an indexer clustering environment?

hagjos43
Contributor

I suppose this is a multi-question post.

We have a clustered environment and are replacing the hardware our search head lives on currently. We have 1 search head, 2 indexers (clustered), and a deployment server/cluster master/license master all in one. Our environment is entirely Windows and last I checked, Search head clustering on Windows is not an option.

The new box will have a new IP and a new hostname.

My question is: Has anyone done this in the past? If so, is it as simple as transferring all of the Splunk files ( d:\program files\splunk\*.*) to the new box? Or is there a subset of files/directories that I can simply transfer (user's/searches/stuff like that).

The issue I see standing out is obviously the name change, and probably why transferring all files over would be a bad idea 🙂

Thanks!

0 Karma
1 Solution

lguinn2
Legend

As of Splunk Enterprise 6.3, search head clustering is supported on Windows.

You can get away with copying over all the files. Then just edit $SPLUNK_HOME\etc\system\local\server.conf
with the updated server information and restart Splunk.

Just don't toss the old search head until you are sure the new one works! 🙂

View solution in original post

lguinn2
Legend

As of Splunk Enterprise 6.3, search head clustering is supported on Windows.

You can get away with copying over all the files. Then just edit $SPLUNK_HOME\etc\system\local\server.conf
with the updated server information and restart Splunk.

Just don't toss the old search head until you are sure the new one works! 🙂

hagjos43
Contributor

Thanks so much!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...