Installation
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

How do I migrate a Splunk indexer cluster to new hardware (RHEL 6 to RHEL 7)?

gregbo
Communicator

I have a Splunk cluster of 1 Search Head, 1 Index Master, and 2 Indexers in a cluster. I need to move all 4 to new hardware. What's the best way to do this?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To move the SH and CM, follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/MigrateaSplunkinstance. Once moved, you may need to update your configurations to point to the new locations.

Install indexers on the new hardware and add them to your cluster. Put the old indexers into detention so they don't receive new data or replicated buckets.

Take down one old indexer using splunk offline --enforce-counts. Wait for all buckets to migrate to other indexers and for the old indexer to stop. Repeat with the other indexer.

---
If this reply helps you, an upvote would be appreciated.
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!