Getting Data In

I am moving form 1 machine to 5 machine on Splunk and i want to know what is the best way to use them?

robertlynch2020
Influencer

Hi

We are upgrading from 1 standalone machine to 5 machines. I am looking to get a cluster up and running.

Originally we were only going to use 4 and have 1 SH and 3 indexers, however, it looks like we have to have a "Master Node".

So is the best way forward 1MN, 1SH, 3 indexers?  Will The MN be used as a SH or will the machine be sitting ideal most of the time? So basically I will have 2 SH and 3 indexers?

Regards

Robert

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you want in indexer cluster then you must have an instance to serve as the Master Node.  The same instance can also serve as your License Master (also a requirement).

I suggest keeping the existing instance as one of the indexers.  That will keep you from having to move a lot of data. 

Designate one of the new machines as the new search head and move user data from the current instance.  Copy the installed apps from the old instance to the new SH.

If you're running Splunk DB Connect then you'll also want an instance to serve as a heavy forwarder which will run DBX.

See https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Migratenon-clusteredindexerstoaclusterede... for more information.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If you want in indexer cluster then you must have an instance to serve as the Master Node.  The same instance can also serve as your License Master (also a requirement).

I suggest keeping the existing instance as one of the indexers.  That will keep you from having to move a lot of data. 

Designate one of the new machines as the new search head and move user data from the current instance.  Copy the installed apps from the old instance to the new SH.

If you're running Splunk DB Connect then you'll also want an instance to serve as a heavy forwarder which will run DBX.

See https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Migratenon-clusteredindexerstoaclusterede... for more information.

---
If this reply helps you, Karma would be appreciated.

robertlynch2020
Influencer

Does the CM (Assuming this is the Master node) Need to sit on a powerful machine in that case, as I have the indexers and the SH on very powerful machines?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

The best practices is not to use CM as a general SH. So I prefer to use your first option SH, CM and 3 IDXc in that cluster.

r. Ismo

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...