Splunk Migration

[athirson]

Hi,

I need an expert opinion on Splunk migration whose data is encrypted. Basically one of our customer want to migrate their Splunk data to different storage platform from the existing one but the challenge here is that Splunk data is encrypted. 

Can someone suggest a tool which can decrypt inline in a migration? Or Is it possible to get splunk to decrypt all of the data before we migrate?

Your inputs are highly appreciated. Thank you.

[athirson]

Hi Ismo,

Thanks for your response. Looks like the customer has enabled encryption on Splunk and data is being stored in Nutanix. There must be at least 40TB of data.

[isoutamo]

For my knowledge Splunk didn't support any native/own method to do data encryption, how this has actually done? I know that there are some apps etc. which can use to (at least) partially encrypt it, but you should know those and what are limitations of those!

How about your Splunk environment? I suppose that there is some kind of cluster for that amount of data? Then probably the easiest way for migration is just add a new peers to that cluster which are using a new storage and then leave migration for splunk internal task. After the data has migrated to new nodes just remove old ones from cluster.

For that you could follow this post https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platf..., of course you need to modify the process to take care only on indexer peers.

[athirson]

In this thread(Solved: Re: Data encryption in Splunk - Splunk Community) it has been mentioned that File system or Block level encryption is possible in On-premise Splunk setup. In that case, is it possible that Nutanix would have applied encryption on Splunk data?

[isoutamo]

Usually encryption has done on filesystem or storage system level. There are several ways to do it based on your environment and products. But you must know what is in use on your environment before you should do a migration!

How about your splunk architecture? Single site cluster vs. multisite? And are you just migrating data to the new environment or something else? If the data migration are migrated from one Nutanix to another then you probably could use Nutanix own tools like MOVE if service break are not an issue to you and you are also migrating those nodes too. But if you cannot keep a service break and you have a splunk cluster then preferred method is what I have presented on above post.

[athirson]

Looks like this Splunk has smartstore with Nutanix storage. It has been integrated to Exchange and using access keys to evict the data. I believe encryption is being enabled at the Storage level. Any idea how do we read and copy the data to the target storage? Is it enough to have the secure/access keys to read the data from the 3rd party tool?

[isoutamo]

It seems that there are quite many components and ways how encryption has/could done. I propose that you will ask help from some local splunk partner or PS to ensure that everything goes well. It’s really hard to help you without seeing your current and future implementations.

[athirson]

Thank you Ismo for all your inputs. Really appreciated.

[isoutamo]

Hi

What you are meaning when you said that data is encrypted? Is it encrypted on storage system internal level, OS filesystem level or how? Based on that you will give the list of possible options. Also how much data you have and which kind of environment you have? 

r. Ismo