Clone Splunk Indexer?

[adalbor]

Hey All,

Off the wall question and was curious if anyone has tried this or not and if its advisable. Looking to add some new indexers (linux) to our cluster and in an attempt to save time our server admin has suggested cloning an existing indexer and performing whatever changes need to be made to hostname, config files, etc.

Two options I see:
1) Clone entire system and use clone-prep-clear-config. Will this even work with an Indexer?
2) Clone entire system and nuke /opt/splunk directory and do a fresh install. Are there any other concerns with this method?

Thanks!
Andrew

[gcusello · Accepted solution]

Hi @adalbor,
how much time do you save in this way?
if you'll forget some step in your cloning procedure you'll lose more time than to start with a new Splunk installation!

Ciao.
Giuseppe

[adalbor]

So due to the fact that our Indexers are Azure servers and required quite a bit of OS customization to align with our company's standards, that is why I was bringing this question up. I am not a fan of the idea and understand the pitfalls and potential issues that could occur down the road but wanted to ask just to do my due diligence.

I personally was thinking clone the server then nuke the Splunk installation directory so the sys admin saves time in setup and I can start from a "fresh install". Just wasn't sure if that would take care of all remaining artifacts from the install.

[gcusello]

I found problems in past when I had a cluster with old parameters, so I maintain My idea: how much time do you save?

Ciao.
Giuseppe

[adalbor]

Did you perform any type of config cleanup? Did you leave the /opt/splunk/ directory intact?

[gcusello]

Hi @adalbor,
you hate to manually modify many configurations:

• hostname in inputs.conf and server.conf;
• server.conf for cluster,
• etc...

I cannot be more detailed because I didn't do it because I don't like this idea.

Ciao.
Giuseppe

[adalbor]

Ok, thanks for the info Giuseppe. Was just gauging the community to see what my options were and to do due diligence.