- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am planning a migration of Splunk Enterprise to a new instance. The old instance consists of a single standalone server. The new one has a search head, an indexer cluster master, and 3 indexer cluster peers.
My original plan was this:
- Add the old standalone server to the new search head as a search peer
- Instruct users to search from the new search head instead of the old standalone server
- Reconfigure my 300+ universal forwarders to send data to the new indexer cluster instead of the old standalone instance
- Retain the old standalone server for 1 year until we no longer need the data, then decommission it
But based on the following documentation, I would also need to deactivate the search role on the old standalone server before performing step 1.
https://docs.splunk.com/Documentation/Splunk/9.0.1/DistSearch/Configuredistributedsearch
Am I interpreting this correctly?
Thanks in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Your plan looks good. I see nothing in the cited document that requires you to "deactivate the search role". Indexers can search, but only themselves and only if users are allowed to log in.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Update: I was able to add the standalone Splunk Enterprise server as a search peer on the new search head without any issues. Search still functions on both the old and new servers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Your plan looks good. I see nothing in the cited document that requires you to "deactivate the search role". Indexers can search, but only themselves and only if users are allowed to log in.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your reply. This is the section that has me worried:
Important: A search head cannot perform a dual function as a search peer. The only exception to this rule is for the monitoring console, which functions as a "search head of search heads."
Maybe I'm misinterpreting this, though.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I can see where that could be confusing. Please submit feedback on the docs page so the team can fix it.
If this reply helps you, Karma would be appreciated.
