Forwarder reconfiguration when migrating Indexer?

[JdeFalconr]

I'm working to migrate our existing Indexer to a new machine. The instructions at https://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/MigrateaSplunkinstance unfortunately are completely silent on the topic of what to do with forwarders.

If the new machine has a different IP than the existing indexer, do you have to manually go to every forwarder and re-point it? That seems thoroughly ridiculous. Alternatively, I see that for distributed environments you're supposed to remove the host to be upgraded from the distributed environment before migration. Would it be an option for my Indexer to remove it from the environment, swap IP addresses for the new and old machine (thus putting the new machine in the same IP as the old), reinstall, update DNS and be off to the races? That would seem to resolve quite a few potential issues.

[malmoore · Accepted solution]

Hi,

Like @codebuilder says, if you have indexer clusters, your best bet is to enable indexer discovery. If you don't have indexer clusters, then going forward you could configure your forwarders to point to a host name rather than an IP address, and subsequently configure DNS to point to the new machine after a migration.

Thank you for the heads up on the hole in documentation re: dealing with forwarders during a migration. We'll add some verbiage about how to deal with forwarders to this topic, and link out to other forwarder-related topics, and include the information discussed here.

Thanks!

[JdeFalconr]

Thank you! My forwarders should already be pointed at a hostname and not an IP. I think what I'll do is be slightly messy and once the old Indexer is gone I'll recycle its A record and turn it into a CNAME that I'll point at the new server. I can also re-IP the new server for good measure.

Thanks too for updating the documentation, that will be most helpful.

[codebuilder]

Yes. If you change the IP address of a indexer, then you will have to update each forwarder that is pointing to it.
An easier way would be to use a deployment server, but even easier is to implement indexer discovery.

[JdeFalconr]

Thank you!