Splunk IT Service Intelligence

Splunk IT Service Intelligence (ITSI) migration to a new search head cluster (SHC) from an old SHC

sylim_splunk
Splunk Employee
Splunk Employee

We want to migrate ITSI from one search head cluster to another search head cluster.

We don’t want to uninstall ITSI on the current/primary working cluster until we know the new search head cluster is functioning.

Is there an easy way to “disable” ITSI on the current/primary cluster so that it doesn’t continue and produce duplicate data?

After we have completely migrated ITSI to the new search head cluster, we will uninstall ITSI from the old one.

Just trying to make sure we don’t have 2 ITSI environments up and running at the same time.

0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

At this moment, you can not “disable” the whole ITSI on a deployment. You could disable all the services so that all the KPI searches will stop running.
One thing that you may consider is to create a separate set of indexes on the same indexer for different ITSI installation. I think we support that in 4.0.x now. Such as, all the index names are like itsi_xxxx and for new one you can create new_itsi_xxxx to prove the new install is working, then remove them after that.

Another way is disable apps/add-ons one by one on old SHC GUI, below are the apps from ITSI;

SA-UserAccess
SA-ITSI-MetricAD
SA-ITSI-Licensechecker
SA-ITSI-CustomModuleViz
SA-ITOA
SA-ITSI-ATAD
itsi
SA-IndexCreation
DA-ITSI-WEBSERVER
DA-ITSI-VIRTUALIZATION
DA-ITSI-STORAGE
DA-ITSI-OS
DA-ITSI-LB
DA-ITSI-EUEM
DA-ITSI-DATABASE
DA-ITSI-APPSERVER

The installation and verification/validation/migration process would vary depending on your requirements and environment. I would like to recommend you to use PS resource for a smooth migration.

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

At this moment, you can not “disable” the whole ITSI on a deployment. You could disable all the services so that all the KPI searches will stop running.
One thing that you may consider is to create a separate set of indexes on the same indexer for different ITSI installation. I think we support that in 4.0.x now. Such as, all the index names are like itsi_xxxx and for new one you can create new_itsi_xxxx to prove the new install is working, then remove them after that.

Another way is disable apps/add-ons one by one on old SHC GUI, below are the apps from ITSI;

SA-UserAccess
SA-ITSI-MetricAD
SA-ITSI-Licensechecker
SA-ITSI-CustomModuleViz
SA-ITOA
SA-ITSI-ATAD
itsi
SA-IndexCreation
DA-ITSI-WEBSERVER
DA-ITSI-VIRTUALIZATION
DA-ITSI-STORAGE
DA-ITSI-OS
DA-ITSI-LB
DA-ITSI-EUEM
DA-ITSI-DATABASE
DA-ITSI-APPSERVER

The installation and verification/validation/migration process would vary depending on your requirements and environment. I would like to recommend you to use PS resource for a smooth migration.

skoelpin
SplunkTrust
SplunkTrust

Good idea about creating a new index for the new ITSI data

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...