Installation

Forwarder reconfiguration when migrating Indexer?

JdeFalconr
Explorer

I'm working to migrate our existing Indexer to a new machine. The instructions at https://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/MigrateaSplunkinstance unfortunately are completely silent on the topic of what to do with forwarders.

If the new machine has a different IP than the existing indexer, do you have to manually go to every forwarder and re-point it? That seems thoroughly ridiculous. Alternatively, I see that for distributed environments you're supposed to remove the host to be upgraded from the distributed environment before migration. Would it be an option for my Indexer to remove it from the environment, swap IP addresses for the new and old machine (thus putting the new machine in the same IP as the old), reinstall, update DNS and be off to the races? That would seem to resolve quite a few potential issues.

Labels (2)
0 Karma
1 Solution

malmoore
Splunk Employee
Splunk Employee

Hi,

Like @codebuilder says, if you have indexer clusters, your best bet is to enable indexer discovery. If you don't have indexer clusters, then going forward you could configure your forwarders to point to a host name rather than an IP address, and subsequently configure DNS to point to the new machine after a migration.

Thank you for the heads up on the hole in documentation re: dealing with forwarders during a migration. We'll add some verbiage about how to deal with forwarders to this topic, and link out to other forwarder-related topics, and include the information discussed here.

Thanks!

View solution in original post

malmoore
Splunk Employee
Splunk Employee

Hi,

Like @codebuilder says, if you have indexer clusters, your best bet is to enable indexer discovery. If you don't have indexer clusters, then going forward you could configure your forwarders to point to a host name rather than an IP address, and subsequently configure DNS to point to the new machine after a migration.

Thank you for the heads up on the hole in documentation re: dealing with forwarders during a migration. We'll add some verbiage about how to deal with forwarders to this topic, and link out to other forwarder-related topics, and include the information discussed here.

Thanks!

JdeFalconr
Explorer

Thank you! My forwarders should already be pointed at a hostname and not an IP. I think what I'll do is be slightly messy and once the old Indexer is gone I'll recycle its A record and turn it into a CNAME that I'll point at the new server. I can also re-IP the new server for good measure.

Thanks too for updating the documentation, that will be most helpful.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Yes. If you change the IP address of a indexer, then you will have to update each forwarder that is pointing to it.
An easier way would be to use a deployment server, but even easier is to implement indexer discovery.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

JdeFalconr
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...