Migrating Splunk Enterprise from one machine to other

[chintan_shah]

Hi,

I need to migrate Splunk Enterprise from one machine to other machine. Currently I am running Splunk 6.4 and wants it to run on Splunk 6.6.

Could someone suggest me the steps to do the same? Should i install Splunk Enterprise 6.4 in new machine and then move all the indexers or then upgrade? or should i install Splunk 6.6 and then move all the indexers?

[rphillips_splk · Accepted solution]

@chintan_shah

You could upgrade to 6.6 on the old machine, install Splunk Enterprise 6.6 on the new machine and then follow steps to migrate a Splunk instance :

https://docs.splunk.com/Documentation/Splunk/6.6.3/Installation/MigrateaSplunkinstance

[chintan_shah]

Hi @rphillips,
As per the documentation, they have mentioned to install Splunk after you have moved the data from one machine to other machine.

[rphillips_splk]

@chintan_shah there shouldn't be an issue if you upgrade the old instance first then proceed with copying the entire contents of the $SPLUNK_HOME directory from the old host to the new host. or you can follow the steps from our docs:

1.]Stop Splunk Enterprise on the host from which you want to migrate.
2.]Copy the entire contents of the $SPLUNK_HOME directory from the old host to the new host.
3.]Install the appropriate version of Splunk Enterprise for the target platform.
4.]Confirm that index configuration files (indexes.conf) contain the correct location and path specification for any non-default indexes.
5.]Start Splunk Enterprise on the new instance.
6.]Log into Splunk Enterprise with your existing credentials.
7.]After you log in, confirm that your data is intact by searching it.

[chintan_shah]

Hi @rphillips,

I have various apps,lookups,schedule searches, reports, dashboards and config file changes. Should all this files be present at Search Head or Indexer?