How to move the entire configuration from one HF to new HF server?

[saibal_das]

Due to some issue, We have to discontinue our existing Heavy Forwarder and move all the sources, data inputs, Splunk TA Apps/add-on one new server where we have already installed Heavy forwarder.

Both of the heavy forwarders are having the same version and present in Linux environment only. So just need to understand how can we easily move all the existing conf files, Splunk TA Apps/add-on and data inputs. So that without hampering any data loss we can move the HF server.

Please add the splunk doc link as well if possible which we can use for linux environment. 

[somesoni2]

Once you've made sure that both HF are equivalent (network/firewall/hardware/software are same), then you can justStop Splunk on old HF , take a backup of $SPLUNK_HOME (/opt/Splunk) on old HF and copy/restore it to new HF. and start/restart on new HF. 

[saibal_das]

Thank you for the overview. It works for me. @somesoni2 

[PickleRick · Accepted solution]

Most of the config should work pretty much the same so moving config should work.

But there are some small things to check:

1. I'd double check whether any scripted/modular inputs don't leave some state information behind.

2. I suppose you're moving to another IP and hostname so verify whether your indexers can accept data from the new forwarder. Check your firewall rules of course as well as any rules limiting inputs from IP and subject names in case you're using mutual TLS.

3. Remember to reconfigure your UFs sending to HFs so they include the new one in their load-balancing group.

[saibal_das]

Thank you for mentioning the small thing. It helps me to understand in a better way and it works for me. @PickleRick