Splunk Enterprise

migrating to new hardware

KulvinderSingh
Path Finder

Splunk offline --enforce-count or data rebalance which one is better in case of migrating to new hardware and do i have to add peer to manual detention in indexer cluster before running a data rebalance or splunkoffline?

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use splunk offline --enforce-count to migrate to new hardware.  A rebalance will shuffle buckets around, but won't remove the old indexer.  If you're only replacing a single indexer then manual detention is not necessary.  However, if this is one of many migrations than consider setting manual detention on each old indexer so they don't receive buckets from the others that are taken down.  It will spare the system from potentially moving the same bucket multiple times.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use splunk offline --enforce-count to migrate to new hardware.  A rebalance will shuffle buckets around, but won't remove the old indexer.  If you're only replacing a single indexer then manual detention is not necessary.  However, if this is one of many migrations than consider setting manual detention on each old indexer so they don't receive buckets from the others that are taken down.  It will spare the system from potentially moving the same bucket multiple times.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...