Migrate Index without shutdown

[mdmurtazaali]

Hi There, We have two indexer (not clustered) but on DNS roundrobin. We need to migrate the indexers to the new hardware and we are planning to do that one by one. For indexer 1 Is there any way to:
1. Copy the files to the new server without shutting down splunk?
2. Can the indexer 1 be readonly from search head?

Thanks,

Mo

[puneethgowda]

Answer for your question is downtime is must

[jcrabb_splunk · Accepted solution]

Here is our documentation that discusses migrating:

http://docs.splunk.com/Documentation/Splunk/6.5.2/Installation/MigrateaSplunkinstance

As you will see in this section, you will need to stop Splunk:

1. Stop Splunk Enterprise on the host from which you want to migrate.
2. Copy the entire contents of the $SPLUNK_HOME directory from the old host to the new host.
3. Install the appropriate version of Splunk Enterprise for the target platform.
4. Confirm that index configuration files (indexes.conf) contain the correct location and path specification for any non-default indexes.
5. Start Splunk Enterprise on the new instance.
6. Log into Splunk Enterprise with your existing credentials.
7. After you log in, confirm that your data is intact by searching it.

While you can make an index read-only, in order to migrate properly, you will need to stop Splunk.

[mdmurtazaali]

Thanks @Jcrabb!