What is the best way to convert standalone splunk instance to search head?

[inters]

Currently, we have a standalone deployment, with about 2 TB of data on it. We want to move to the recommended architecture of 3 indexers, 1 indexer cluster master, 1 license manager/monitoring console, and 1 search head because of our anticipated increase of log ingestion.

We want to keep our current standalone server as the new search head because we’re pretty far deep with custom reports/dashboards/extracted fields/etc.
The documentation here https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Migratenon-clusteredindexerstoaclusterede... recommends just adding the current standalone server as an indexer to the cluster, but that doesn’t work for our scenario because we want to keep it as the search head. I’ve already set up and configured all of the new indexers, cluster master, and license manager/monitoring console, just trying to figure out the best way how to migrate the standalone server to the search head without losing all of our custom reports/dashboards/extracted fields/etc and also keeping all of our current data.

Whats the best path forward?

[koshyk]

IMO, the migration in your case might break things slightly. enabling TLS may make it bit more complex.

1. Best approach is to take all your custom searches, configuration items etc, into an app. Name the app with higher ASCII order and deploy into your existing deployment. And slowly remove all your old configurations one by one without any impact. After you do this, you have a consistent copy of Search config items which you can migrate
2. Then prepare the index clustering. 3 indexers is not a good figure. Better to have 4 or above (even numbers). Try for replication factor of 2 atleast. https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Clusterconfigurationoverview
3. Ensure you enable TLS and keys accordingly to communicate between SH tier and indexer. You need CLM also to manage indexer cluster