Installation

How do I migrate a Splunk indexer cluster to new hardware (RHEL 6 to RHEL 7)?

gregbo
Communicator

I have a Splunk cluster of 1 Search Head, 1 Index Master, and 2 Indexers in a cluster. I need to move all 4 to new hardware. What's the best way to do this?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To move the SH and CM, follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/MigrateaSplunkinstance. Once moved, you may need to update your configurations to point to the new locations.

Install indexers on the new hardware and add them to your cluster. Put the old indexers into detention so they don't receive new data or replicated buckets.

Take down one old indexer using splunk offline --enforce-counts. Wait for all buckets to migrate to other indexers and for the old indexer to stop. Repeat with the other indexer.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...