Getting Data In

I am moving form 1 machine to 5 machine on Splunk and i want to know what is the best way to use them?

robertlynch2020
Motivator

Hi

We are upgrading from 1 standalone machine to 5 machines. I am looking to get a cluster up and running.

Originally we were only going to use 4 and have 1 SH and 3 indexers, however, it looks like we have to have a "Master Node".

So is the best way forward 1MN, 1SH, 3 indexers?  Will The MN be used as a SH or will the machine be sitting ideal most of the time? So basically I will have 2 SH and 3 indexers?

Regards

Robert

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you want in indexer cluster then you must have an instance to serve as the Master Node.  The same instance can also serve as your License Master (also a requirement).

I suggest keeping the existing instance as one of the indexers.  That will keep you from having to move a lot of data. 

Designate one of the new machines as the new search head and move user data from the current instance.  Copy the installed apps from the old instance to the new SH.

If you're running Splunk DB Connect then you'll also want an instance to serve as a heavy forwarder which will run DBX.

See https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Migratenon-clusteredindexerstoaclusterede... for more information.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If you want in indexer cluster then you must have an instance to serve as the Master Node.  The same instance can also serve as your License Master (also a requirement).

I suggest keeping the existing instance as one of the indexers.  That will keep you from having to move a lot of data. 

Designate one of the new machines as the new search head and move user data from the current instance.  Copy the installed apps from the old instance to the new SH.

If you're running Splunk DB Connect then you'll also want an instance to serve as a heavy forwarder which will run DBX.

See https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Migratenon-clusteredindexerstoaclusterede... for more information.

---
If this reply helps you, Karma would be appreciated.

robertlynch2020
Motivator

Does the CM (Assuming this is the Master node) Need to sit on a powerful machine in that case, as I have the indexers and the SH on very powerful machines?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

The best practices is not to use CM as a general SH. So I prefer to use your first option SH, CM and 3 IDXc in that cluster.

r. Ismo

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...