Splunk Enterprise Security

Remove Search Head roles from an Indexer

andresito123
Communicator

Hello to the community!

I was wondering if there is any best practices regarding the removal of Search Head role from an indexer and moving it to a new server. I have started as a "demo" installation with a machine with indexer and SH role, so I need to remove all activities of the SH and move them to the new machine. Is there any documentation on performing such task? The SH also contains Enterprise Security App.

Thanks,
Andreas

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi Andreas,

If you would like to have dedicated search heard, following steps might help you

Once you have the "new" search head installed, copy the searches and apps to the new search head

  • Do not copy the whole search "app" since it might create unexpected issues later. Instead of that copy the 'local' folder from your search app which should have your searches/macros/dashboards etc.
  • Check if you have something in your user's local directory if there are some objects which are not shared in the app. https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Apparchitectureandobjectownership should give you an overview about the object permissions.
  • You shall copy other 'apps' from the etc/apps folder directly to the new search head to the same location which includes your "Enterprise Security App"
  • And as mentioned in Forward search head data, forward the data from SH to the "old" indexer.
  • Disable scheduled searches on indexer once you have enabled them in the "new" search head. Make sure you are doing disable/enable on both search head simultaneously/without much time gap to avoid duplicate alerts. This includes searches from "app" as well.
  • Regarding enterprise security, you should keep other configuration files on indexer for e.g. indexes,props,transforms as mentioned in http://docs.splunk.com/Documentation/ES/5.1.0/Install/Indexes
  • Disable the search head on indexer to prevent users from using it (best practice) Setting » Server settings » General settings and select "No" for 'Run Splunk Web' [ or from cmd line ./splunk disable webserver]

Lets know in case you have further questions.

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi Andreas,

If you would like to have dedicated search heard, following steps might help you

Once you have the "new" search head installed, copy the searches and apps to the new search head

  • Do not copy the whole search "app" since it might create unexpected issues later. Instead of that copy the 'local' folder from your search app which should have your searches/macros/dashboards etc.
  • Check if you have something in your user's local directory if there are some objects which are not shared in the app. https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Apparchitectureandobjectownership should give you an overview about the object permissions.
  • You shall copy other 'apps' from the etc/apps folder directly to the new search head to the same location which includes your "Enterprise Security App"
  • And as mentioned in Forward search head data, forward the data from SH to the "old" indexer.
  • Disable scheduled searches on indexer once you have enabled them in the "new" search head. Make sure you are doing disable/enable on both search head simultaneously/without much time gap to avoid duplicate alerts. This includes searches from "app" as well.
  • Regarding enterprise security, you should keep other configuration files on indexer for e.g. indexes,props,transforms as mentioned in http://docs.splunk.com/Documentation/ES/5.1.0/Install/Indexes
  • Disable the search head on indexer to prevent users from using it (best practice) Setting » Server settings » General settings and select "No" for 'Run Splunk Web' [ or from cmd line ./splunk disable webserver]

Lets know in case you have further questions.

Happy Splunking!
0 Karma

andresito123
Communicator

Thank you very much for your answer!

One more question: how I can offload the indexer from the SH tasks? Delete enterprise security?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Added the steps. In short, once you move the scheduled searches to the new search most of the load should be offloaded.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...