https://community.splunk.com/t5/Deployment-Architecture/What-to-do-with-old-splunk-server/m-p/353098#M13109 <P>We have a single Splunk Enterprise server deployment. Recently, we migrated it to newer hardware (SSD drives, etc). The old machine is still a decent piece of equipment, just has less disk space. I've been reading about clustering, or adding an indexer. Would like to make use of the old machine for additional index storage and search, but it seems not worth doing a cluster with only two machines. Also, if I just added an indexer role, I have concerns about re-pointing forwarders there, etc. Any ideas? Anyone else been through something similar, where your older machine had not been "stolen" away and you can make use of it? Thanks in advance!</P> Thu, 01 Feb 2018 15:13:33 GMT tcary99 2018-02-01T15:13:33Z https://community.splunk.com/t5/Deployment-Architecture/What-to-do-with-old-splunk-server/m-p/353098#M13109 <P>We have a single Splunk Enterprise server deployment. Recently, we migrated it to newer hardware (SSD drives, etc). The old machine is still a decent piece of equipment, just has less disk space. I've been reading about clustering, or adding an indexer. Would like to make use of the old machine for additional index storage and search, but it seems not worth doing a cluster with only two machines. Also, if I just added an indexer role, I have concerns about re-pointing forwarders there, etc. Any ideas? Anyone else been through something similar, where your older machine had not been "stolen" away and you can make use of it? Thanks in advance!</P> Thu, 01 Feb 2018 15:13:33 GMT https://community.splunk.com/t5/Deployment-Architecture/What-to-do-with-old-splunk-server/m-p/353098#M13109 tcary99 2018-02-01T15:13:33Z https://community.splunk.com/t5/Deployment-Architecture/What-to-do-with-old-splunk-server/m-p/353099#M13110 <P>This'll vary greatly depending on your needs, your users, and your environment (especially in comparison to your volume).</P> <P>First, you can't cluster two indexers without adding a third appliance, a Cluster Master, but you can still employ it as a search peer -<BR /> non-clustered indexer - to balance the load.</P> <P>A couple other ideas...</P> <UL> <LI>Offload smaller roles, like License Manager or Deployment Server, onto it.</LI> <LI>Create a dedicated DMC</LI> </UL> Thu, 01 Feb 2018 20:15:49 GMT https://community.splunk.com/t5/Deployment-Architecture/What-to-do-with-old-splunk-server/m-p/353099#M13110 johnvr 2018-02-01T20:15:49Z