Splunk Enterprise

Migration of Indexer clustering to new servers

dvohra
Explorer

Hi All. I am working on Splunk migration project which involves moving of Splunk instances to new servers. Till now I managed to document the steps of CM, Deployer and SHC clustering. I am unable to find any detailed steps for Indexer clustering. Can anyone in this forum guide me with the procedure. In our environment Splunk is running with Indexer clustering(2 servers). Thanks !

0 Karma

soutamo
SplunkTrust
SplunkTrust
0 Karma

dvohra
Explorer

@soutamo Yes. So as per my understanding the procedure is

1. stop  Old Indexers and forwarders

2. Install Splunk on 2 new Indexers(enable clustering) to CM and integrate them with SHC just like a new setup.

3. Copy useful config files or Splunk DB directory from Old to New servers.

4. Point the forwarders to new Indexers.

5. Start the new indexers and forwarders.

 

 

0 Karma

dvohra
Explorer

@soutamo . Could you please confirm. Many thanks !

0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

my preferred way is extend current cluster with those new nodes an after that remove old nodes. That way you could do it with minimum interruption for service. If you are using (you should) indexer discovery then there is no need to update forwarders configuration for indexers as that has managed automatically.

of course you could do that part manually as you propose, but as I said I prefer other way.

r. Ismo

0 Karma

dvohra
Explorer

Thank you for replying. One last question as we add two new Indexers to the CM, do we need to update the RF and SF also ? Presently the value is set to 2.

0 Karma

soutamo
SplunkTrust
SplunkTrust

No need to update those. Just add nodes, then rebalance and then remove old ones. I’m not sure if rebalancing is actually needed, but In our cases it was mandatory do first rebalancing as we have much more nodes on new sites.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!