Install Splunk on the new VMs and add them to the existing indexer cluster.
Put the old indexers into manual detention
splunk edit cluster-config -auth <username>:<password> -manual_detention on
For each indexer on the old VMs:
- Down the indexer using the splunk off-line --enforce-counts command
- Wait for the cluster to balance the buckets. The indexer will stop itself.
Install a new Cluster Manager on the new VMs. Point the new indexers to the new CM.
splunk edit cluster-config -mode peer -master_uri https://<CM URI>:8089 -replication_port 9887 -secret your_key
splunk restart
Shut down the old CM.
---
If this reply helps you, Karma would be appreciated.
