Splunk Enterprise Security

How to migrate data in an indexer cluster to a new indexer cluster environment?

syazwani
Path Finder

Hi peeps,

I need some information about migrating data from an instance in a cluster environment to a new cluster environment. I was unable to find documentation about this process, so I would like to get some advice or pros/cons details from the experts. Please help.

Thank you. 

Labels (2)
0 Karma

MaverickT
Communicator

The easiest option is to add new indexers/nodes to existing cluster, sync existing data to this nodes and after that slowly retire old indexers using "splunk offline --enforce-counts" command.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

can you describe more about your current and target environment?

Are you replacing current one with then new cluster (see: https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platf...)? 

Are both clusters using same OS (type like linux) and splunk version?

Online or offline migration is preferred and how much time you have for it?

r. Ismo

0 Karma

syazwani
Path Finder

Hi @isoutamo,

Thanks for replying. Our current environment is multisite indexer cluster environment and we will plan to decommission the system with hardware. Our target environment is also multisite indexer cluster with new hardware. 

We are not replacing the new environment, we are migration to new environment. We are planning to cutover to the new cluster approcahes.

We are using the same OS and the splunk version will be from 8.2 to 8.3

We are going for online migration and we dont have a specific time period.

Thank you.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Here is the way how I have done this kind of operations. 

https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platf...

I think that it's the easiest way to do it and basically no real service break to end users.

You should use just those indexer cluster parts from this workflow.

If you are doing Splunk version update, then you should do it before or after the migration not at same time!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...