Installation

Forwarder reconfiguration when migrating Indexer?

JdeFalconr
Explorer

I'm working to migrate our existing Indexer to a new machine. The instructions at https://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/MigrateaSplunkinstance unfortunately are completely silent on the topic of what to do with forwarders.

If the new machine has a different IP than the existing indexer, do you have to manually go to every forwarder and re-point it? That seems thoroughly ridiculous. Alternatively, I see that for distributed environments you're supposed to remove the host to be upgraded from the distributed environment before migration. Would it be an option for my Indexer to remove it from the environment, swap IP addresses for the new and old machine (thus putting the new machine in the same IP as the old), reinstall, update DNS and be off to the races? That would seem to resolve quite a few potential issues.

Labels (2)
0 Karma
1 Solution

malmoore
Splunk Employee
Splunk Employee

Hi,

Like @codebuilder says, if you have indexer clusters, your best bet is to enable indexer discovery. If you don't have indexer clusters, then going forward you could configure your forwarders to point to a host name rather than an IP address, and subsequently configure DNS to point to the new machine after a migration.

Thank you for the heads up on the hole in documentation re: dealing with forwarders during a migration. We'll add some verbiage about how to deal with forwarders to this topic, and link out to other forwarder-related topics, and include the information discussed here.

Thanks!

View solution in original post

malmoore
Splunk Employee
Splunk Employee

Hi,

Like @codebuilder says, if you have indexer clusters, your best bet is to enable indexer discovery. If you don't have indexer clusters, then going forward you could configure your forwarders to point to a host name rather than an IP address, and subsequently configure DNS to point to the new machine after a migration.

Thank you for the heads up on the hole in documentation re: dealing with forwarders during a migration. We'll add some verbiage about how to deal with forwarders to this topic, and link out to other forwarder-related topics, and include the information discussed here.

Thanks!

JdeFalconr
Explorer

Thank you! My forwarders should already be pointed at a hostname and not an IP. I think what I'll do is be slightly messy and once the old Indexer is gone I'll recycle its A record and turn it into a CNAME that I'll point at the new server. I can also re-IP the new server for good measure.

Thanks too for updating the documentation, that will be most helpful.

0 Karma

codebuilder
Influencer

Yes. If you change the IP address of a indexer, then you will have to update each forwarder that is pointing to it.
An easier way would be to use a deployment server, but even easier is to implement indexer discovery.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

JdeFalconr
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...