I've searched and seen a few migration threads, but my setup is a bit strange.
Two physical servers, 1st running splunk search head in /opt/splunk_sh, a splunk indexer in /opt/splunk_ind, and the deploy server under /opt/splunk_ds. The second physical server is running a splunk indexer in /opt/splunk_ind. All are running version 5.0.1.
I'd like to move onto 6.3.0, and so I've setup a VM for that purpose, and the plan is to move the search head function to the new vm. I'm now concerned about my order of operations:
1. stop splunk_sh on old server 1
2. copy /opt/splunk_sh to new server as /opt/splunk
3. install splunk6.3 on new server
4. startup new server
Once that's satisfied, upgrade the splunk indexers to 6.3?
Also, I need to move the deployment server off the old server to new vm, as well as license server. Uncertain about that order of operations as well.
Any advice is welcome here.
↧