Knowledge Management

How to migrate indexes and fields

xsstest
Communicator

A:I have a stand-alone Splunk Enterprise,This includes search, indexing。
B:Now,I built a Splunk cluster,The Splunk cluster includes (three search servers, three index servers, one deployment server, multiple universal forwarders).

question:

 How to migrate stand-alone version of the Splunk index and the field to the cluster (search  servers)

Also: Is there a talk about Splunk's technical group? May i join?

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

First you'll want a firm understanding of index time versus search time field extractions and transformations by reading over the props.conf and transforms.conf documentation.

Then you can pretty much just follow these articles:

http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Migratenon-clusteredindexerstoaclustereden...

http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/Migratefromstandalonesearchheads

You'll note they say contact splunk PS for migrating the data. It can be easier to just leave the old standalone indexer up and running and use it as a search peer on the new SHC. Migrating the data requires a bit of scripting to attach the cluster guid to the bucket file names, and also needs to take into consideration the possibility of bucket collisions and other posibillities... Which is why they recommend contacting PS if it's absolutely necessary.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

What do you mean about joining Splunks technical group?

There is a slack channel and an irc channel open to the public.

0 Karma

jkat54
SplunkTrust
SplunkTrust

First you'll want a firm understanding of index time versus search time field extractions and transformations by reading over the props.conf and transforms.conf documentation.

Then you can pretty much just follow these articles:

http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Migratenon-clusteredindexerstoaclustereden...

http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/Migratefromstandalonesearchheads

You'll note they say contact splunk PS for migrating the data. It can be easier to just leave the old standalone indexer up and running and use it as a search peer on the new SHC. Migrating the data requires a bit of scripting to attach the cluster guid to the bucket file names, and also needs to take into consideration the possibility of bucket collisions and other posibillities... Which is why they recommend contacting PS if it's absolutely necessary.

skoelpin
SplunkTrust
SplunkTrust

How many concurrent searches do you have? I would suggest making an index cluster first then move to a search head cluster when you have more users searching.

First step would be to create the master node instance, then create your indexers, then search heads. You should join each instance to the license pool and setup your DS and forwarders.

I think you will need to manually add the data to your clustered indexers since old data will not populate onto the new nodes

Here's a link discussing rebalancing data along the nodes

http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Rebalancethecluster

You should also look into joining the Splunk Slack channel

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...