How do I migrate a Splunk indexer cluster to new hardware (RHEL 6 to RHEL 7)?


I have a Splunk cluster of 1 Search Head, 1 Index Master, and 2 Indexers in a cluster. I need to move all 4 to new hardware. What's the best way to do this?

Labels (2)
0 Karma


To move the SH and CM, follow the instructions at Once moved, you may need to update your configurations to point to the new locations.

Install indexers on the new hardware and add them to your cluster. Put the old indexers into detention so they don't receive new data or replicated buckets.

Take down one old indexer using splunk offline --enforce-counts. Wait for all buckets to migrate to other indexers and for the old indexer to stop. Repeat with the other indexer.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...