Deployment Architecture

How to migrate Splunk Heavy Forwarder to a new server?

lucas4394
Path Finder

Hi all, how to migrate Splunk Heavy Forwarder to a new server?  

Thanks.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

remember that you must copy splunk.secret before you start HF first time. 
Otherwise your plan should work. If there are some other apps with different versions I would like to start with current version and then update it. Of course there are some exceptions for that. And remember shutdown those apps/inputs before you copy data and checkpoints to the new HF otherwise there will be duplicate events. 
r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

is it mandatory to migrate it or just add new one and remove old when the new is in the use?

r. Ismo

0 Karma

lucas4394
Path Finder

Hi @isoutamo , thank you for your quick response.  We are going to retire the old servers and it is mandatory to migrate the Heavy Forwarder to the new servers.  My major concern is there are lots of apps with module inputs, api call, dbconnect, etc. with encrypted password or security keys on the HF, and last checkpoints are might be stored some common folders, etc.  What is the best way to handle them?  Thanks.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you do rpm installations and then rsync data’s and applications from here old one or do you need to update versions at the same time or later?

r. Ismo

0 Karma

lucas4394
Path Finder

Hi @isoutamo , my initial plan was to install the new version of Splunk on the new server, then migrate apps by apps to the new one, but  I don't have confidence for my approach due to encrypted password and last checkpoint from the apps.

0 Karma

ChrisH
Explorer

Copying the splunk.secret from the old heavy forwarder to the new one should help with the passwords.

isoutamo
SplunkTrust
SplunkTrust

Hi

remember that you must copy splunk.secret before you start HF first time. 
Otherwise your plan should work. If there are some other apps with different versions I would like to start with current version and then update it. Of course there are some exceptions for that. And remember shutdown those apps/inputs before you copy data and checkpoints to the new HF otherwise there will be duplicate events. 
r. Ismo

lucas4394
Path Finder

thanks.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>