Deployment Architecture

Consolidating Splunk servers

sc0tt
Builder

We currently have Splunk running on two separate servers in a distributed search environment. However, we need to eliminate the second server and consolidate Splunk to a single instance. I came across a similar question (Consolidate Databases from multiple splunk instances).

Is this process still the same for Splunk 6? Are there any potential issues with doing this? Existing searches and reports will still need to access the historical data from Splunk 2.

Thanks in advance.

0 Karma

treinke
Builder

You might want to look at using Shuttl to move the data from the second server to the first.

Shuttl:
http://apps.splunk.com/app/1195/

There are no answer without questions

sc0tt
Builder

FYI - After following up with Splunk it appears that the most recent version of Shuttl is not compatible with Splunk 6. However, manually copying the bucket folders should be simple enough.

0 Karma

sc0tt
Builder

One more question - do you know if Shuttl is compatible with Splunk 6? On the app page it only shows 5.0 and 4.3.

0 Karma

sc0tt
Builder

Awesome. I've already moved searches over and have been using them on Splunk 1 so everything should continue to work as expected. I plan on consolidating in the next day or two, so I'll report back. Thanks again!

0 Karma

treinke
Builder

Correct. If you have any saved searches on server you would need to move them over also, but Shuttl really makes the process easier.

There are no answer without questions
0 Karma

sc0tt
Builder

Thanks. My understanding is that the only thing I would need to do is to redirect traffic to Splunk 1 and then use Shuttl to manage the moving of data from Splunk 2 to Splunk 1. Is this correct? If so, this seems like it may be simpler than I initially imagined.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...