Hi @haleyh44 , one additional information: do you want HA on your data or not? to have HA you need to create an Indexer Cluster, that requires an additiona machine (Cluster Manager) that cannot be ...
See more...
Hi @haleyh44 , one additional information: do you want HA on your data or not? to have HA you need to create an Indexer Cluster, that requires an additiona machine (Cluster Manager) that cannot be one of the others. Anyway, the two new machines have different requirements, in terms of Disk Space: the new Indexers should have the same storage of the old server. If you don't want HA, you have to: install Splunk on the two new servers, copy the indexes.conf and the Technology Add-Ons from the old server to one of the other two that will be one of the two Indexers, copy all the apps from the old server to the new server that will be the Search Head, configure the Search head for a Distributed Search as described in the links shared by @JohnEGones If you want HA, you have to: install Splunk on three new servers, Configure an Indexers Cluster on the old server and two of the new ones, copy the indexes.conf and the Technology Add-Ons from the old server to the Cluster Manager, copy all the apps from the old server to the new server that will be the Search Head, configure the Search head for a Distributed Search as described in the links shared by @JohnEGones for more infos about Splunk architectures see at https://www.splunk.com/en_us/pdfs/tech-brief/splunk-validated-architectures.pdf Ciao. Giuseppe