Installation

How do I migrate a Splunk indexer cluster to new hardware (RHEL 6 to RHEL 7)?

gregbo
Communicator

I have a Splunk cluster of 1 Search Head, 1 Index Master, and 2 Indexers in a cluster. I need to move all 4 to new hardware. What's the best way to do this?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To move the SH and CM, follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/MigrateaSplunkinstance. Once moved, you may need to update your configurations to point to the new locations.

Install indexers on the new hardware and add them to your cluster. Put the old indexers into detention so they don't receive new data or replicated buckets.

Take down one old indexer using splunk offline --enforce-counts. Wait for all buckets to migrate to other indexers and for the old indexer to stop. Repeat with the other indexer.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...