How to migrate data in an indexer cluster to a new indexer cluster environment?

[syazwani]

Hi peeps,

I need some information about migrating data from an instance in a cluster environment to a new cluster environment. I was unable to find documentation about this process, so I would like to get some advice or pros/cons details from the experts. Please help.

Thank you. 

[MaverickT]

The easiest option is to add new indexers/nodes to existing cluster, sync existing data to this nodes and after that slowly retire old indexers using "splunk offline --enforce-counts" command.

[isoutamo]

https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platf... this links contains those exact steps which are needed including remove old peers from CM! As "splunk offline --enforce-counts" is not enough.

[isoutamo]

Hi

can you describe more about your current and target environment?

Are you replacing current one with then new cluster (see: https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platf...)? 

Are both clusters using same OS (type like linux) and splunk version?

Online or offline migration is preferred and how much time you have for it?

r. Ismo

[syazwani]

Hi @isoutamo,

Thanks for replying. Our current environment is multisite indexer cluster environment and we will plan to decommission the system with hardware. Our target environment is also multisite indexer cluster with new hardware. 

We are not replacing the new environment, we are migration to new environment. We are planning to cutover to the new cluster approcahes.

We are using the same OS and the splunk version will be from 8.2 to 8.3

We are going for online migration and we dont have a specific time period.

Thank you.

[isoutamo]

Here is the way how I have done this kind of operations. 

https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platf...

I think that it's the easiest way to do it and basically no real service break to end users.

You should use just those indexer cluster parts from this workflow.

If you are doing Splunk version update, then you should do it before or after the migration not at same time!