https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677328#M27900 <P>Assuming you've verified 12 indexers can handle both the indexing and search loads, then you just need to remove 12 indexers.&nbsp;</P><P>1. Remove 12 indexers from outputs.conf on all instances.&nbsp; Ideally, you have this in an app so you can make the change once an push it to where it is needed (SHs, forwarders, DS, MC, CM, LM).&nbsp; If you've implemented Indexer Discover then you can skip this step.</P><P>2. Put the 12 indexers into manual detention.&nbsp; This will keep them from accepting new data or replicated buckets.</P><LI-CODE lang="markup">splunk edit cluster-config -auth &lt;username&gt;:&lt;password&gt; -manual_detention on</LI-CODE><P>3. Run this command on each indexer being removed.</P><LI-CODE lang="markup">splunk offline --enforce-counts</LI-CODE><P>Wait for the indexer to stop before proceeding to the next.</P> Mon, 12 Feb 2024 18:56:34 GMT richgalloway 2024-02-12T18:56:34Z https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677322#M27897 <P>Hi Team,<BR />I need to decrease the number of indexers used to half, in my current configurations we have site replication factor is 5 in total with origin:3 and site searchfactor is defined as 3 in total and origin:2.<BR /><BR />My total number of indexers is 24 and I want to decrease the count of indexers to 12.<BR /><BR />I want to have the complete process of reducing the indexer cluster size so that the buckets which have site information will not be impacted.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bapun18_0-1707762622976.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29345i522D62FC00DB6B03/image-size/medium?v=v2&amp;px=400" role="button" title="bapun18_0-1707762622976.png" alt="bapun18_0-1707762622976.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bapun18_1-1707762666289.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29346i5406A59445392B36/image-size/medium?v=v2&amp;px=400" role="button" title="bapun18_1-1707762666289.png" alt="bapun18_1-1707762666289.png" /></span></P><P>&nbsp;</P> Mon, 12 Feb 2024 18:34:22 GMT https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677322#M27897 bapun18 2024-02-12T18:34:22Z https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677323#M27898 <P>Why do you want to reduce the number of indexers?&nbsp;</P><P>What problem are you trying to solve?&nbsp;</P><P>Can 12 indexers handle the workload currently done by 24 indexers?</P> Mon, 12 Feb 2024 18:38:08 GMT https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677323#M27898 richgalloway 2024-02-12T18:38:08Z https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677325#M27899 <P>Yes, it can handle.. Data volume reduced, so there is no point of keeping 24 indexers.&nbsp;</P> Mon, 12 Feb 2024 18:40:37 GMT https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677325#M27899 bapun18 2024-02-12T18:40:37Z https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677328#M27900 <P>Assuming you've verified 12 indexers can handle both the indexing and search loads, then you just need to remove 12 indexers.&nbsp;</P><P>1. Remove 12 indexers from outputs.conf on all instances.&nbsp; Ideally, you have this in an app so you can make the change once an push it to where it is needed (SHs, forwarders, DS, MC, CM, LM).&nbsp; If you've implemented Indexer Discover then you can skip this step.</P><P>2. Put the 12 indexers into manual detention.&nbsp; This will keep them from accepting new data or replicated buckets.</P><LI-CODE lang="markup">splunk edit cluster-config -auth &lt;username&gt;:&lt;password&gt; -manual_detention on</LI-CODE><P>3. Run this command on each indexer being removed.</P><LI-CODE lang="markup">splunk offline --enforce-counts</LI-CODE><P>Wait for the indexer to stop before proceeding to the next.</P> Mon, 12 Feb 2024 18:56:34 GMT https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677328#M27900 richgalloway 2024-02-12T18:56:34Z https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677380#M27907 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/204073">@bapun18</a>&nbsp;,</P><P>The number of indexers depends on the daily indexed logs, on the number of scheduled searches and active users.</P><P>how many of them do you have?</P><P>can your reducted Indexers manage your volume?</P><P>In my opinion only a Splunk Architect can answer to this question.</P><P>Ciao.</P><P>Giuseppe&nbsp;</P> Tue, 13 Feb 2024 09:35:37 GMT https://community.splunk.com/t5/Deployment-Architecture/I-need-to-down-size-the-number-of-indexers-to-half/m-p/677380#M27907 gcusello 2024-02-13T09:35:37Z