Splunk Enterprise Security

How to move the entire configuration from one HF to new HF server?

saibal_das
Explorer

Due to some issue, We have to discontinue our existing Heavy Forwarder and move all the sources, data inputs, Splunk TA Apps/add-on one new server where we have already installed Heavy forwarder.

Both of the heavy forwarders are having the same version and present in Linux environment only. So just need to understand how can we easily move all the existing conf files, Splunk TA Apps/add-on and data inputs. So that without hampering any data loss we can move the HF server.

Please add the splunk doc link as well if possible which we can use for linux environment. 

0 Karma
1 Solution

PickleRick
Ultra Champion

Most of the config should work pretty much the same so moving config should work.

But there are some small things to check:

1. I'd double check whether any scripted/modular inputs don't leave some state information behind.

2. I suppose you're moving to another IP and hostname so verify whether your indexers can accept data from the new forwarder. Check your firewall rules of course as well as any rules limiting inputs from IP and subject names in case you're using mutual TLS.

3. Remember to reconfigure your UFs sending to HFs so they include the new one in their load-balancing group.

View solution in original post

somesoni2
Revered Legend

Once you've made sure that both HF are equivalent (network/firewall/hardware/software are same), then you can justStop Splunk on old HF , take a backup of $SPLUNK_HOME (/opt/Splunk) on old HF and copy/restore it to new HF. and start/restart on new HF. 

saibal_das
Explorer

Thank you for the overview. It works for me. @somesoni2 

0 Karma

PickleRick
Ultra Champion

Most of the config should work pretty much the same so moving config should work.

But there are some small things to check:

1. I'd double check whether any scripted/modular inputs don't leave some state information behind.

2. I suppose you're moving to another IP and hostname so verify whether your indexers can accept data from the new forwarder. Check your firewall rules of course as well as any rules limiting inputs from IP and subject names in case you're using mutual TLS.

3. Remember to reconfigure your UFs sending to HFs so they include the new one in their load-balancing group.

saibal_das
Explorer

Thank you for mentioning the small thing. It helps me to understand in a better way and it works for me. @PickleRick 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...