Are there any recommended strategies for moving the index data to a new data center?
We're planning to build up a new Splunk cluster (indexers, searchheads, master, license-master) in a new data center. We want to migrate the existing index data. The most straightforward solution would probably be:
shut down old cluster
copy indexer data
start new cluster
However, we have sth. like 4-5TB of index data, so that would take a real long amount of (down) time.
Are there better solutions? I was thinking about extending the existing indexer cluster to the new DC, increase the repl. factor so that it's guaranteed that one of the indexers in the new DC must have the data. Then when everything is synced, shut down the old indexers, disconnect the new indexers from the old master, connect them to the new master. Done Has anyone had experience with such a scenario? Or any other proposed solutions?
... View more