Installation

I am setting up parallel Splunk environment of my existing setup what is best approach for data backup?

vikas_gopal
Builder

Hi Experts,

I have 8 server setup (2 indexers in cluster, 3 SH, 1 CM, 1 Deplyer,LM,1 DS) on splunk 6.5. This setup is migrating as the servers will be decommissioned. So I have to migrate existing setup to not only new splunk version but also all data to the new setup on new servers . My biggest concern is on the data that resides on the existing setup

--> How I will take backup of my existing indexer cluster and restore it in new setup ?
--> Will taking backup of hot/warm/cold/frozen and put these backups on the new splunk setup under data location using 6.5 and after restore I will upgrade to 7.6 is it a good approach ?
--> Do I need to stop indexers and take backup of only one indexer and then take that to new machines ? OR both the indexer backup is required . I wonder both indexer data is duplicate data .

I have checked splunk docs to take data backup like https://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Backupindexeddata but I am still not sure for cluster backup.

Regards
VG

Labels (2)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

You have to follow the process to upgrade on the buckets prior to migration OR you have to start with 6.5 on the new servers and follow the upgrade path there.

Since upgrading a clustered environment requires a special process, you should follow the docs.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/HowtoupgradeSplunk

There's really no great method to backup splunk. Instead I would stand up the new servers as a new site, point everything at the new servers, then shut down the old cluster when the data is no longer needed.

This would be an intricate process, and I would highly recommend professional services for something like that/this.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

You have to follow the process to upgrade on the buckets prior to migration OR you have to start with 6.5 on the new servers and follow the upgrade path there.

Since upgrading a clustered environment requires a special process, you should follow the docs.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/HowtoupgradeSplunk

There's really no great method to backup splunk. Instead I would stand up the new servers as a new site, point everything at the new servers, then shut down the old cluster when the data is no longer needed.

This would be an intricate process, and I would highly recommend professional services for something like that/this.

vikas_gopal
Builder

Thank you jkat54 , as always it was helpfull.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...