What would be the best way to upgrade our Splunk environment and add additional indexers and forwarders?

[jkponnuri]

I have an existing Splunk setup with 2 indexers and 2 forwarders with a clustered architecture. Now we are trying to upgrade and introduce new h/w for syslog and additional forwarders and indexers. What would be the best way to upgrade this environment?

[renjith_nair]

Try these links

https://answers.splunk.com/answers/6521/expanding-splunk-installation-from-a-single-indexer-to-a-mul...

http://docs.splunk.com/Documentation/Splunk/6.3.0/Installation/UpgradeyourdistributedSplunkEnterpris...