steps to move universal forwarder from oracle database server to other without loosing any app config/setting

[mahenreddy]

I am new to splunk, can i get advice on moving splunk universal forwarder from one db host to another.
I am looking for options where i don't have to configure whole lot on the target.

I tried SPLUNK HOME tar ball to target server, change the hostname in .conf files. I see the data coming but i don't see the
sourcetype options , tags, dashboards

Thanks

[mguhad · Accepted solution]

Hi,
If it is simply a universal forwarder:
1.Ensure that the new db host has the same source paths for the files it is monitoring as the old one
2.Ensure the deployment server is up to date with the client (that way, once the UF phones home under new db host, it can simply push the same app out again to resume service as usual....the caveat being the new db host has the same exact input.conf stanzas as the old db you are moving from)
3. Install the forwarder on the new db host
4. Point the forwarder to the deployment server : ./splunk set deploy-poll <deploymentserver>:8089
5. Once the forwarder is phoning home from the new db host, attach the same apps & serverclass as previous db forwarder and push out to the client - ./splunk reload deploy-server

Once the new forwarder begins to send data to the indexers, the dashboards and other knowledge objects should begin populating as per usual witht the previous setup.

[mahenreddy]

Thanks a lot . Everything is working fine.

[richgalloway]

@mahenreddy If your problem is resolved then please accept the answer to help future readers.

[mahenreddy]

Thanks a lot for detailed reply.

[mahenreddy]

Thanks for the detailed step by step explanation . It resolved the issue.