Getting Data In

Best practices when migrating a Windows search head to new physical hardware in an indexer clustering environment?

hagjos43
Contributor

I suppose this is a multi-question post.

We have a clustered environment and are replacing the hardware our search head lives on currently. We have 1 search head, 2 indexers (clustered), and a deployment server/cluster master/license master all in one. Our environment is entirely Windows and last I checked, Search head clustering on Windows is not an option.

The new box will have a new IP and a new hostname.

My question is: Has anyone done this in the past? If so, is it as simple as transferring all of the Splunk files ( d:\program files\splunk\*.*) to the new box? Or is there a subset of files/directories that I can simply transfer (user's/searches/stuff like that).

The issue I see standing out is obviously the name change, and probably why transferring all files over would be a bad idea 🙂

Thanks!

0 Karma
1 Solution

lguinn2
Legend

As of Splunk Enterprise 6.3, search head clustering is supported on Windows.

You can get away with copying over all the files. Then just edit $SPLUNK_HOME\etc\system\local\server.conf
with the updated server information and restart Splunk.

Just don't toss the old search head until you are sure the new one works! 🙂

View solution in original post

lguinn2
Legend

As of Splunk Enterprise 6.3, search head clustering is supported on Windows.

You can get away with copying over all the files. Then just edit $SPLUNK_HOME\etc\system\local\server.conf
with the updated server information and restart Splunk.

Just don't toss the old search head until you are sure the new one works! 🙂

hagjos43
Contributor

Thanks so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...