Splunk server migration to another server

[jiaqya]

need guidance on situation below

server1 with splunk install to be migrated to server2.

plan is to detach the disk from server1 and attach it to server2.

the server names will be different.

do i need to run a install of same version on top of it on server2 ,  as the server.conf and other files will have the old servername i.e server1 in its conf files..

[inventsekar · Accepted solution]

1. Stop the Splunk Enterprise on the host from which you want to migrate.
2. your plan - detach the disk from server1 and attach it to server2.
3. Install the appropriate version of Splunk Enterprise for the target platform.
4. Confirm that index configuration files (indexes.conf) contain the correct location and path specification for any non-default indexes.
5. One more task - Edit the server.conf and inputs.conf in the etc/system/local directory of the new server to reflect the new server name and any other parameters you may want to change.
6. Start Splunk Enterprise on the new instance.
7. Log into Splunk Enterprise with your existing credentials.
8. After you log in, confirm that your data is intact by searching it.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/MigrateaSplunkinstance

https://community.splunk.com/t5/Installation/Splunk-Migration-to-another-server/m-p/186974

(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun")

[jiaqya]

Hi, thanks for the steps.

is it really necessary to run the splunk intsall on the new server , even when i detach and attach the disk...

the disk with /opt/splunk has the full setup .

i understand to change the server.conf and inputs.conf, which ill take care.. but wanted to know if the splunk install was necessary in this case...

thanks

[inventsekar]

PS - 2 karma points were given and i got notified and read and wanted to edit my answer to these questions,... and sorry for my wrong answer last time, hope nobody followed it 😉 even if somebody followed it, no harm done, the system will not work "workable splunk" 😉 )

>>>is it really necessary to run the splunk intsall on the new server , even when i detach and attach the disk...
Yes, it is necessary to install Splunk once again(when u install the splunk, if the instance is already having the splunk, then, the installer script will detect the existing install and will ask you - do u really want to install or upgrade, etc)

>>>the disk with /opt/splunk has the full setup.

the installer script "intelligently" will take care this situation and ask your confirmation.

>>>i understand to change the server.conf and inputs.conf, which ill take care.. but wanted to know if the splunk install was necessary in this case...
it is suggested to add the drive from old system to the new system and then install the splunk on new system. the installer script will "understand" the existing data, version, etc. 

EDIT - (PS - my karma stats - given 2000 and received 500. thanks for reading )

[inventsekar]

is it really necessary to run the splunk intsall on the new server , even when i detach and attach the disk...///

not need to run the Splunk install, as the disk is already having Splunk install.

[jiaqya]

great, thank you