Possible to merge two existing search heads on one host without pooling?

[mirandainfusion]

Currently I am working with two hosts that have search head and indexer functionality. I am looking at moving the search heads off of their current indexers and merging them into one search head. How would you cleanly move and merge the two search heads?

[martin_mueller · Accepted solution]

The cleanest would be to have apps built for each group of use cases on each search head, export those apps, and import them onto the new united search head.

...chances are your search heads aren't that well-organized though, so you'll probably need to first clean up unneeded old stuff, then take the relevant configs from both search heads (fields, searches, alerts, dashboards, tags, eventtypes, macros, lookups, yada yada) and merge them manually.

Do both search heads serve the same use cases or are they completely disjunct? If the latter then the merging should be quick and painless.

[martin_mueller]

Say you have a dashboard on both search heads that essentially does the same thing. Unless they are identical underneath the key question is "which dashboard is better?" If the answer to that is A or B then keep that dashboard on the united search head and drop the other... however, if the answer is "a little of both" then you need to manually merge the good things from A with the good things from B. There's no way around this manual effort, same thing applies to all the other objects... and every type of object is potentially vital to that use case, so you need to focus on everything in the local directories.

[mirandainfusion]

Thank you @martin_mueller! That is a really helpful start. Both search heads have some different use cases but there is some overlap. What will I need to focus on when I merge the use cases that are on both search heads?