Migrate Splunk servers from Rocky Linux To ORACLE Linux

[xamanium]

We've decided to migrate our Splunk servers from Rocky Linux VM to Oracle Linux version 10 due to support issues.

we have 3 indexers , 3 Search heads, 2 HFs, Deployer, Cluster Master, Deployment Server and License Server.

we run Splunk 10.2.5.  i've read the migration Doc.

but it seems tricky to do this way! I run a test scenario and copied the splunk home of my old search head to new host and then install the Splunk the same version as it was. but I ran into some error when I started the splunk. The old Splunk instances are installed via root user but now tried to use  non-root user.

so far I have some dilemma about migration. Have anyone experienced the Splunk instances migration? and the best way to get around it ?

[PickleRick]

Well, these problems are not related to Splunk itself. Migrating between two different OS-es can prove to be challenging. Switching from running the service as root (which is a bad idea) to a dedicated service user adds another layer of complexity and possible problems.

Yes, I've done some migrations like this (actually I'm in the middle of one right now 🙂 ) and they require careful planning and testing. While migration from an old physical box to a new one all other things remaining the same can indeed be easy-peasy - a migration with fundamental changes to your environment usually are better done by spawning a parallely working new instance(s) and migrating pieces of config, verifying them and switching over your sources/users and so on. That's the least risky approach I belive.

[xamanium]

you're right! I kind of handle the OS problem but the real question is base on the mentioned architecture should I install Splunk on new hosts first? and then copy the splunk_home directory from my old host to it?

and what a about Indexers? I just want change the OS . is it possible to unmount indexers bucket from old host and mount it on new host?

[livehybrid]

Hi @xamanium 

What errors did you run into when you tried starting Splunk? This would give us a good direction on how to help. 

Did you ensure the permissions etc were correct and the files were owned by the correct user?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[xamanium]

the error was related to fapolicy in linux. I made some changes in the policy conf file and now it's ok. to run splunk. the real question is base on the mentioned architecture should I install Splunk on new hosts first? and then copy the splunk_home directory from my old host to it?

and what a about Indexers? I just want change the OS . is it possible to unmount indexers bucket from old host and mount it on new host?