The customer wants to migrate their current Splunk Index cluster to new hardware to improve indexing and search performance. What is the correct process and procedure for this task?
The customer wants to migrate their current Splunk Index cluster to new hardware to improve indexing and search performance. What is the correct process and procedure for this task?
To safely migrate a Splunk Index cluster to new hardware while maintaining continued indexing and search performance, the correct procedure involves several critical steps. First, you install new indexers. Then, these new indexers are configured as peers within the cluster and must receive the cluster bundle and the same configuration as the existing peers. Next, update the forwarders to send data to the new peers to ensure a smooth transition. Only after the forwarders are correctly sending data to the new peers should you proceed to decommission the old peers, doing so one at a time to maintain cluster stability. Finally, remove the old peers from the Cluster Master's (CM's) list to complete the process. This order ensures that all necessary configurations are applied, data continuity is maintained, and the cluster remains stable throughout the migration process.
Should be D. Clustered Indexers will not received configs from DS
D is the correct order
It should be D.
I also go with D I think the Forwarders should be updated befor decomissioning the old peers so that they do not try to send to already decomissioned systems...
C and A are wrong as the DS is not used for Index Cluster management or IDX apps B could also be be used if want to age out data on the existing peers or ensure that the new peers are receiving data before taking the existing peers offline
D is fine
Agree that A and C are not valid because of the DS. I will tend to agree with D, but B is valid also.