How do I migrate a Splunk indexer cluster to new hardware (RHEL 6 to RHEL 7)?

[gregbo]

I have a Splunk cluster of 1 Search Head, 1 Index Master, and 2 Indexers in a cluster. I need to move all 4 to new hardware. What's the best way to do this?

[richgalloway]

To move the SH and CM, follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/MigrateaSplunkinstance. Once moved, you may need to update your configurations to point to the new locations.

Install indexers on the new hardware and add them to your cluster. Put the old indexers into detention so they don't receive new data or replicated buckets.

Take down one old indexer using splunk offline --enforce-counts. Wait for all buckets to migrate to other indexers and for the old indexer to stop. Repeat with the other indexer.