Can you tell me the way to monitor these performances irrespective of hardware. ... View more

Thanks for the details. But there is a config File which is global for all indexes $SPLUNK_HOME/etc/splunk-launch. conf Do we need to make any changes there ? ... View more

Yes you are right. So finally it worked when i pushed the bundle and surprisingly when i added the other two nodes it was not required to push the bundles again. Thank you for the help. Cheers ! ... View more

Thanks. As per the documentation the default push mode is merge_to_default. splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>  So the above command should not overwrite the existing configurations. Let me try with that. B.R ... View more

My biggest fear is if i apply shcluster-bundle command it will overwrite the existing settings saved-searches/dashboards/alerts on SHC members since I last push. shccluster always contains old data but not the replicated one which was exchanged between SHC members. Please correct my understanding.  ... View more

Yes SHC status and KV store status is successful and i am no longer seeing the old node but new node. Regarding Shcluster-bundle command , i didn't apply as document suggests that new node automatically takes the configuration from Deployer, we don't need to push anything specifically. ... View more

Hi @gcusello @isoutamo  Today I tried the same but has fallen in some issue. Our Replication factor of SHC is 3. So we added a new Node, added it to SHC and CM. Removed one OLD Node which makes 2 OLD and 1 NEW Node in SHC. Searches and Reports,alerts have been replicated perfectly but Apps have been migrated partially. We don't know whats the reason behind this. Could you please help. Regards, Devang ... View more

Thank you for replying. One last question as we add two new Indexers to the CM, do we need to update the RF and SF also ? Presently the value is set to 2. ... View more

Thanks so we will follow the same approach. one last question  1. How do we know that bundles are replicated so that we can proceed to other nodes.  2. Did you follow the same approach with Index clustering.     ... View more

@isoutamo . Could you please confirm. Many thanks ! ... View more

@isoutamo Yes. So as per my understanding the procedure is 1. stop  Old Indexers and forwarders 2. Install Splunk on 2 new Indexers(enable clustering) to CM and integrate them with SHC just like a new setup. 3. Copy useful config files or Splunk DB directory from Old to New servers. 4. Point the forwarders to new Indexers. 5. Start the new indexers and forwarders.     ... View more

@isoutamo I have small confusion on the steps to migrate index clustering(3 servers) to new hardware. I am not able to find any procedure or Splunk docs. Could you please help me out with the steps if possible. Thanks  ... View more

Thank you for providing the detailed procedure. Couple of questions:- 1.  When you migrated Splunk Enterprise to new servers, did you just copy/paste the configs. SHC(OLD) to SHC(NEW), Indexer(OLD) to Indexer(New) etc and then install Splunk over it OR first install Splunk and then copy/paste OR created a new CM,SHC,Indexer just like a new architect and copy the configs. 2.  You mentioned no user was impacted so did you managed to complete the activity same day ? 3.  I believe you have updated the Splunk forwarders to point to the indexers just after the activity. It seems while you migrated instance one by one you made sure that Splunk is able to communicate with CM(NEW) and SHC/INDEXER(OLD). Is it correct understanding ? Thanks. ... View more

No Difference in search results but warning is not there in splunkd.log If i am creating props.conf at UF also, it is stopping data ingestion also. ... View more