Migrate to new server, splitting hot/warm and cold in the process

[Branden]

Hi.

We are moving our Splunk Enterprise instance to a new server. We have a simple environment: 1 shared indexer/search head.
The new server has 300 GB of high-performance SSD space, and a magnetic disk array 13 TB in size.

The hot/warm path will be the 300 GB SSD disks and will be configured to rotate to cold after about 7 days (I did the math using Splunk's calculator). The cold buckets will be on the 13 TB array.

That's fine, but the initial sync of hot/warm buckets of my various indexes will exceed the 300 GB available on the SSD. What I was thinking: on the original Splunk server, roll all hot/warm buckets to cold, then do the sync. Then I'd configure indexes.conf on the new server, specifying the new hot/warm path and cold path. So it would start with nothing in hot/warm SSD storage; everything in cold, then new data would go to hot/warm storage.

Does this make sense? Is there a better approach to this? I did see this post:
https://answers.splunk.com/answers/478697/migrating-hotwarm-and-cold-buckets-to-separate-dri.html?ut...

But in that scenario, they appeared to have enough space in hot/warm to accommodate the migration.

Thank you!

[woodcock]

There is no reason to have Splunk roll your buckets. When you do the copy, just move all of the files out of the warm directory into the cold directory. There is nothing special about them other than where they are. I have done similar migrations before just like this.

[chrisyounger · Accepted solution]

You can just move buckets manually if you want. So leave the old splunk as it is. Just copy/move the buckets to the cold dir of the new server. That should work fine.

See the last comment on this answers post from a Splunk employee: https://answers.splunk.com/answers/8471/how-can-i-manually-move-buckets-from-warm-to-cold.html

[chrisyounger]

I don't see any problems with your approach. I have done something similar before.

[Branden]

Thank you for your comment. One thing I'm having trouble with, however, is rolling the warm buckets to cold. There does not appear to be a manual way to do this. Or is there? The only suggestion I can find is something like this:

maxWarmDBCount=0

for each index.
Is there a better way?
Also, I assume I'd need to stop Splunk from receiving events while this roll-over occurs, is that right?

Thank you!