Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: switch forwarders to new indexer
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
switch forwarders to new indexer
Hi,
I have existing indexer with 6.0 version and same version for all forwarders.
Now we got new splunk physical server with version 6.1.1,
Not I am switching forwarder to new server by replacing server attribute. However its not able to forward to new.
please suggest me what i have to consider before moving to new server ? Is data file will affect to due to this ? Please suggest me solution.
outputs.conf
[tcpout]
defaultGroup=DBGroup
[tcpout:DBGroup]
server =alpputl018:9997
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First step before migrating between platform is to check the network connectivty
Ping alpputl018
telnet alpputl018 "receiving_port/9997"
new server will not be having the receiving configured. Check it right away.
Check the forwarder logs what is the issue if is not able to connect.
Thanks,
L
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not played with indexes.conf in old or new server.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what about indexes.conf? same config on old and new server?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. its opened
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is tcp port 9997 open on new index server?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Adding more details. _internal logs are seeing in new server but not application log.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IS data monitoring pointer will affect due to this ?
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
