Getting Data In

Best practices when migrating a Windows search head to new physical hardware in an indexer clustering environment?

Contributor

I suppose this is a multi-question post.

We have a clustered environment and are replacing the hardware our search head lives on currently. We have 1 search head, 2 indexers (clustered), and a deployment server/cluster master/license master all in one. Our environment is entirely Windows and last I checked, Search head clustering on Windows is not an option.

The new box will have a new IP and a new hostname.

My question is: Has anyone done this in the past? If so, is it as simple as transferring all of the Splunk files ( d:\program files\splunk\*.*) to the new box? Or is there a subset of files/directories that I can simply transfer (user's/searches/stuff like that).

The issue I see standing out is obviously the name change, and probably why transferring all files over would be a bad idea 🙂

Thanks!

0 Karma
1 Solution

Legend

As of Splunk Enterprise 6.3, search head clustering is supported on Windows.

You can get away with copying over all the files. Then just edit $SPLUNK_HOME\etc\system\local\server.conf
with the updated server information and restart Splunk.

Just don't toss the old search head until you are sure the new one works! 🙂

View solution in original post

Legend

As of Splunk Enterprise 6.3, search head clustering is supported on Windows.

You can get away with copying over all the files. Then just edit $SPLUNK_HOME\etc\system\local\server.conf
with the updated server information and restart Splunk.

Just don't toss the old search head until you are sure the new one works! 🙂

View solution in original post

Contributor

Thanks so much!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!