migrating to new hardware

[KulvinderSingh]

Splunk offline --enforce-count or data rebalance which one is better in case of migrating to new hardware and do i have to add peer to manual detention in indexer cluster before running a data rebalance or splunkoffline?

[richgalloway · Accepted solution]

Use splunk offline --enforce-count to migrate to new hardware.  A rebalance will shuffle buckets around, but won't remove the old indexer.  If you're only replacing a single indexer then manual detention is not necessary.  However, if this is one of many migrations than consider setting manual detention on each old indexer so they don't receive buckets from the others that are taken down.  It will spare the system from potentially moving the same bucket multiple times.