Migrating Heavy Forwarder to a new server

[cnuguri_ncc]

Hi All,

I have inherited a HF running on a Linux server collecting data from several cloud sources using the inputs from below TAs, that need to be moved to a newly built Linux server (no Splunk version upgrades).

azure_event_hub
azure_security_center_input
digital_shadows_searchlight
microsoft_graph_security
MS_AAD_audit
MS_AAD_signins
mscs_azure_audit
mscs_azure_resource
splunk_ta_o365_management_activity
windows_defender_atp_alerts

Can you please recommend any procedures and best practices to make sure there is no data duplication ?

Thinking of the below ways, will any of these work and which is better ?

1.

    a. Stop Splunk on old host and copy Splunk directory to new host.
    b. Change the splunk server/instance name to match the new host.
    c. Start splunk on the new host.

2. Install fresh Splunk on new host, and configure TAs, is there a way to move any checkpoints (or something similar to fishbuckets ? ) from the old HF, so that the TAs pull data from where it was stopped on the existing HF ?

Thanks a lot in advance

Chaith

[thambisetty · Accepted solution]

Best way is to move Splunk app on HF since you have checkpoints for modular inputs.

stop splunk on old instance.

create same splunk user which is used on existing server on new server.

just copy $SPLUNK_HOME to new splunk instance

and change instance name and hostname in 

system/local/server.conf and inkuts.conf if you are going to have new hostname to new server you have configured. You can continue using same hostname if you are decommissioning existing HF.

then start splunk on new instance.

[cnuguri_ncc]

Thanks a lot !

[fahmed11]

Did this work? Did you discover that you had to implement additional steps to make it work?

Thanks,
Farhan

[thambisetty]

Great. You are welcome.