Indexer Cluster Migration to VM with different OS

[aguilard]

Hello, 

We have an multisite indexer cluster with Splunk Enterprise 9.1.2 running in Red-hat 7 VMs and we need to migrate them to others VMs but with Red-Hat 9.

From documentation it's been required that all members of a cluster must have the same OS and version.

I was thinking to simply add one new indexer (redhat 9 vm) at the time and dettach an old one forcinf the buckets count. So for a short-time the cluster would have members with different OS versions.

Upgrading from Red-Hat 7 to Red.Had 9 directly in the splunk enviroment is not possible.

I would like to know if there are critical issues to face while the migration is happening?  I hope the procedure won't last more than 2 days.

[pmerlin1]

Nous avons du faire face au même défi mais pour notre cas nous devions migrer la version OS et la version Splunk en même temps :
Nous avons créer un cluster d'indexer avec la nouvelle version OS et version Splunk. Ce cluster ingère les nouvelles données
Nous avons conserver une seule instance de l'ancien cluster d'indexer en lecture seule pour requêter les données historiques
Le cluster de search head était branché sur tous les peers, le cluster d'indexer et l'indexer standalone.
Une fois les durées de rétention expirées, nous avons décommissionné l'ancien indexer.

[pmerlin1]

We faced the same challenge, but in our case we had to migrate the OS version and the Splunk version at the same time:
We created an indexer cluster with the new OS version and Splunk version. This cluster ingests the new data
We kept a single instance of the old read-only indexer cluster to query historical data.
The search head cluster was connected to all peers, the indexer cluster and the standalone indexer.
Once the retention times had expired, we decommissioned the old indexer.

[isoutamo]

Basically you shouldn’t migrate both os and splunk at the same time. Just select which one you do first and after you have finalized it and check couple of days that everything is ok, then do the second migration. Of course if you have new host where to migrate then those os can be migrated earlier and just migrate splunk into those. Again you could migrate splunk before node migration or after it, but don’t try it the same time (e.g. new hosts have newer version).
Here is how I have done it earlier https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platf...
r. Ismo

[richgalloway · Accepted solution]

The procedure you're thinking of is common and works well.  Good luck!