Hi everyone, I’m currently planning to migrate an existing Splunk Enterprise All-in-One instance (Search Head + Indexer + License Master + Deployment Server in a single node) that also runs Splunk Enterprise Security (ES) into a new Splunk Clustered Architecture, which will include: 1x Cluster Manager 3x Indexers 1x Search Head Cluster (3x SH + 1x Deployer) 1x License Master / Deployment Server 2x Heavy Forwarder The plan is to keep the old All-in-One instance available for historical searches only during the transition, and eventually decommission (recycle) it once all data and workloads have been fully migrated. Additionally, I’m planning to upgrade to the latest versions — Splunk Enterprise v10.x and Splunk Enterprise Security v8.2, if supported and compatible during migration. (Current Version are Splunk Enterprise v9.0.3 and Splunk ES v7.1.0) Specifically: What is the best approach to migrate existing data (apps, add-on, etc), ES configurations, and correlation searches from the All-in-One instance to the new clustered environment? Should I first build the cluster (with ES installed on the SHC) and then migrate data/configurations, or can I reuse parts of the old ES setup directly? What’s the recommended way to integrate the old instance for historical search access during the migration period? What’s the recommended way to handle the UF data sources — e.g., when and how to repoint them to the new Heavy Forwarder? Appreciate any insight, recommendation on what is the better way do to this. Thank you in advance!
... View more