Hi,
We have an application running in production on Splunk Enterprise version 6.5.1. The data available in the production indexer cluster needs to migrated to a new instance of indexer clusters. These new indexers are running on 6.5.1 too.
Can you please suggest how the indexed data can be migrated to the new indexer clusters?
Thanks a lot.
I am in a similar situation and would like to know what you finally selected and went ahead with. Did you go ahead with what woodcock suggested.
We typically do not migrate data. It is possible but it is easy to make a mistake and then you have a big mess. Instead, what we do is move the new indexers to production including updating them as search peers. Then change outputs.conf everywhere to only point to the new indexers. Because nothing new is coming to the old indexers, you just wait for the data to age out naturally and then decommission them.
What about if we have to migrate to a new hardware due to warranty or hardware issues?
Do you think this approach would work for an indexer cluster single-site?
You will have to restart the CM after every indexer swap out but that should work fine.
Hey @pedroponchio, since this original post is from February -- please create a new Answers post. You can include a link to this post to reference what you've already researched and then specify the difference in your environment and conditions.