https://community.splunk.com/t5/Getting-Data-In/Data-Archiving-and-Clusters/m-p/133169#M27366 <P>Yes, at the time of archiving if the cluster master dashboard is green, then you can take backup from a single server.</P> Thu, 21 Nov 2013 19:22:37 GMT mahamed_splunk 2013-11-21T19:22:37Z https://community.splunk.com/t5/Getting-Data-In/Data-Archiving-and-Clusters/m-p/133168#M27365 <P>I have a clustered Splunk set up with 3 indexing peers and a replication factor of 3. There are a couple of indexes that need to be archived when frozen instead of deleted, but I want to avoid having duplicate copies. The documentation mentions: "You cannot solve this problem by archiving just the data on a single node, since there's no certainty that a single node contains all the data in the cluster." </P> <P>However, I'm thinking that only applies when you've got more indexers than your search factor. Since the number of indexers = replication factor, each server should have all the buckets and thus I would be able to just keep buckets from one of them. Am I missing something?</P> Thu, 07 Nov 2013 17:40:06 GMT https://community.splunk.com/t5/Getting-Data-In/Data-Archiving-and-Clusters/m-p/133168#M27365 mcclainsm47 2013-11-07T17:40:06Z https://community.splunk.com/t5/Getting-Data-In/Data-Archiving-and-Clusters/m-p/133169#M27366 <P>Yes, at the time of archiving if the cluster master dashboard is green, then you can take backup from a single server.</P> Thu, 21 Nov 2013 19:22:37 GMT https://community.splunk.com/t5/Getting-Data-In/Data-Archiving-and-Clusters/m-p/133169#M27366 mahamed_splunk 2013-11-21T19:22:37Z