switch forwarders to new indexer

[rameshlpatel]

Hi,

I have existing indexer with 6.0 version and same version for all forwarders.

Now we got new splunk physical server with version 6.1.1,

Not I am switching forwarder to new server by replacing server attribute. However its not able to forward to new.

please suggest me what i have to consider before moving to new server ? Is data file will affect to due to this ? Please suggest me solution.

outputs.conf
[tcpout]
defaultGroup=DBGroup

[tcpout:DBGroup]
server =alpputl018:9997

[linu1988]

First step before migrating between platform is to check the network connectivty

Ping alpputl018
telnet alpputl018 "receiving_port/9997"

new server will not be having the receiving configured. Check it right away.

Check the forwarder logs what is the issue if is not able to connect.

Thanks,
L

[rameshlpatel]

Not played with indexes.conf in old or new server.

[harald_leitl]

what about indexes.conf? same config on old and new server?

[rameshlpatel]

Yes. its opened

[harald_leitl]

is tcp port 9997 open on new index server?

[rameshlpatel]

Adding more details. _internal logs are seeing in new server but not application log.

[rameshlpatel]

IS data monitoring pointer will affect due to this ?