Installation

Upgrading to new cluster

responsys_cm
Builder

We currently have a single Splunk server with a large storage array. We're in the process of building out a new Splunk 5 cluster. What's the best process for getting my old data into the new cluster? Do I make the cluster a license slave of the old server and then just enable forwarding on the old server to the new cluster? Will that cause all of my old indexed data to migrate to the new cluster without blowing through the license?

Thx.

C

Tags (2)
0 Karma

ChrisG
Splunk Employee
Splunk Employee

You can add your existing indexer to the cluster as a peer, but note that the cluster will not replicate any index buckets that already exist on that indexer. There is a documentation topic in the Managing Indexers and Clusters manual that talks about this.

sowings
Splunk Employee
Splunk Employee

I've accomplished this "provide access to legacy data while implementing new cluster" goal by creating a separate "cluster of one", with replication factor of 1, searchable factor of 1 containing just the legacy indexer(s). The search head then refers to both cluster masters. The legacy indexer doesn't receive any data, but will participate in searches until it is retired.

Note that placing an existing indexer in a cluster with RF > 1 may result in data being replicated to it. If the goal is to retire the old hardware, the separate cluster approch is probably your best bet.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

There are no major changes to this aspect of clustering in Splunk Enterprise 6.0. From that same documentation topic: You can add a non-clustered indexer to a cluster (as a peer node) at any time. To do so, just enable the indexer as a peer, then it participates in the cluster the same as any other peer. Any new data coming into the peer gets replicated according to the replication factor, and the peer is also a candidate for receiving replicated data from other peers. Data already on the indexer does not get automatically replicated, but it does participate in searches.

0 Karma

shawn8592
New Member

Does this change with Version 6?

0 Karma

adrianathome
Communicator

From reading the documentation you have two way to proceed.
1.The process of migrating data is too expensive and not worth it.
2. Splunk professional services.

0 Karma

responsys_cm
Builder

I want to move my data from the old server to the new cluster to take advantage of the higher performing I/O in the cluster...

Will my approach work?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...