Hi All. I am working on Splunk migration project which involves moving of Splunk instances to new servers. Till now I managed to document the steps of CM, Deployer and SHC clustering. I am unable to find any detailed steps for Indexer clustering. Can anyone in this forum guide me with the procedure. In our environment Splunk is running with Indexer clustering(2 servers). Thanks !
@soutamo Yes. So as per my understanding the procedure is
1. stop Old Indexers and forwarders
2. Install Splunk on 2 new Indexers(enable clustering) to CM and integrate them with SHC just like a new setup.
3. Copy useful config files or Splunk DB directory from Old to New servers.
4. Point the forwarders to new Indexers.
5. Start the new indexers and forwarders.
my preferred way is extend current cluster with those new nodes an after that remove old nodes. That way you could do it with minimum interruption for service. If you are using (you should) indexer discovery then there is no need to update forwarders configuration for indexers as that has managed automatically.
of course you could do that part manually as you propose, but as I said I prefer other way.
No need to update those. Just add nodes, then rebalance and then remove old ones. I’m not sure if rebalancing is actually needed, but In our cases it was mandatory do first rebalancing as we have much more nodes on new sites.