This post is regarding moving configurations from one Splunk environment to another. I work on the support side of the corporation where I work. We rely on Splunk for reports, alerts, event types, data models, tags, ect. We are not responsible for the hands on work of maintaining Splunk and rely on an entirely different business unit for that. They can be territorial, siloed and difficult to deal with. We desperately want the hard work of our support teams to utilize Splunk to be carried over to the new environment. This is the reason I am here.
I am asking for guidance on what is needed and where to find the configs that are needed to be migrated to the new environment. The current environment consists of 3 clustered search heads, 2 indexer clusters of 2 indexers each (4 total). I have tried previously to guide others in the other business unit to where the configs are without luck. My only reference is a Splunk Enterprise instance on my laptop. Since I am not allowed to look at or touch these servers I have to guide others on how to do it. I have zero information about the target environment for the migration unfortunately.
We also have an issue where the Splunk forwarder agent on a particular server that becomes non-responsive from the amount of logs events ingested. Any suggestions on how to fix this are appreciated.
Regards.
Forgot to add that this concerns
Splunk Enterprise
Version:7.2.3
