Migration of Indexer clustering to new servers

[dvohra]

Hi All. I am working on Splunk migration project which involves moving of Splunk instances to new servers. Till now I managed to document the steps of CM, Deployer and SHC clustering. I am unable to find any detailed steps for Indexer clustering. Can anyone in this forum guide me with the procedure. In our environment Splunk is running with Indexer clustering(2 servers). Thanks !

[isoutamo]

Hi

here is old answer to this question https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platf...

r. Ismo

[dvohra]

@isoutamo Yes. So as per my understanding the procedure is

1. stop  Old Indexers and forwarders

2. Install Splunk on 2 new Indexers(enable clustering) to CM and integrate them with SHC just like a new setup.

3. Copy useful config files or Splunk DB directory from Old to New servers.

4. Point the forwarders to new Indexers.

5. Start the new indexers and forwarders.

[dvohra]

@isoutamo . Could you please confirm. Many thanks !

[isoutamo]

Hi

my preferred way is extend current cluster with those new nodes an after that remove old nodes. That way you could do it with minimum interruption for service. If you are using (you should) indexer discovery then there is no need to update forwarders configuration for indexers as that has managed automatically.

of course you could do that part manually as you propose, but as I said I prefer other way.

r. Ismo

[dvohra]

Thank you for replying. One last question as we add two new Indexers to the CM, do we need to update the RF and SF also ? Presently the value is set to 2.

[isoutamo]

No need to update those. Just add nodes, then rebalance and then remove old ones. I’m not sure if rebalancing is actually needed, but In our cases it was mandatory do first rebalancing as we have much more nodes on new sites.