Spleak Search Head Migration from VM to Physical host

[anirudhk]

I have a distributed Splunk setup with a server as (Search Head + Deployment Server + License Server) capabilities and 2 Indexers. We are expanding our enterprise architecture and would like to migrate the Search Head to a Physical as compared to VM that it is installed on currently.

How would I go about migrating the search head to physical by leaving the license server and Deployment server functionality.

Thanks
Anirudh

[kaufmanm · Accepted solution]

You can install Splunk on the new server and then set up the distributed search settings through the UI under Settings -> Distributed Search, adding all the search peers that the VM currently connects to. You'll also likely want to copy over some custom apps or user settings that reside in /opt/splunk/etc/apps and /opt/splunk/etc/users respectively. You can leave the VM as is, or once you have the new search head set up, you could remove the search peers through the UI, or by removing them from /opt/splunk/etc/system/local/distsearch.conf. There's no cost to having two servers configured for distributed search, so I don't see a good reason to turn that off.