<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: What happens to the data if the indexer in an indexer cluster goes down? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234270#M45659</link>
    <description>&lt;P&gt;Thanks Chris&lt;/P&gt;</description>
    <pubDate>Fri, 07 Oct 2016 21:55:34 GMT</pubDate>
    <dc:creator>sreejith2k2</dc:creator>
    <dc:date>2016-10-07T21:55:34Z</dc:date>
    <item>
      <title>What happens to the data if the indexer in an indexer cluster goes down?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234267#M45656</link>
      <description>&lt;P&gt;I have 12 Indexers (6 each/site) in a  multi cluster environment. Data is replicated to the other site with RF =2 and SF =2, so even if one indexer (INDX01) goes down due to network issues, the indexer which is down currently holds data will be replicated to the other available 5 servers.&lt;/P&gt;

&lt;P&gt;My question is, what happens to the data once that Indexer INDX01 is back (say after 2 days) to the cluster?&lt;/P&gt;

&lt;P&gt;Will the indexer (INDX02 - 05)  servers will start replicating the same data which is already there into the indexer (INDX01)? If so, will it have 3 copies, or it will delete the data? &lt;/P&gt;

&lt;P&gt;Also, what is the case, if I enable maintenance mode once I come to know that the server is going to be offline for more than 24hrs, and what if I haven't enabled the maintenance mode?&lt;/P&gt;</description>
      <pubDate>Wed, 05 Oct 2016 22:54:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234267#M45656</guid>
      <dc:creator>sreejith2k2</dc:creator>
      <dc:date>2016-10-05T22:54:24Z</dc:date>
    </item>
    <item>
      <title>Re: What happens to the data if the indexer in an indexer cluster goes down?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234268#M45657</link>
      <description>&lt;P&gt;When INDX01 comes back on line, it sends a list of all of its buckets to the cluster master.  The cluster may end up with excess buckets, which you can remove from the master's UI.  &lt;/P&gt;

&lt;P&gt;Bear in mind that the indexers won't replicate on their own, unless the master is down.  The master tells the indexers which buckets to replicate and where to send them.  So, the other indexers won't send data to INDX01 that it already has.  If INDX01 needs to have buckets to satisfy SF or RF, the master will tell the other indexers to replicate as needed.&lt;/P&gt;

&lt;P&gt;If you &lt;STRONG&gt;do not&lt;/STRONG&gt; enable maintenance mode while INDX01 is down, the master will tell your remaining indexers to replicate all of the buckets that INDX01 had when it went down -- in order to satisfy SF and RF.  That can cause issues if you're short on disk space.  If you do enable maintenance mode, the SF and RF are not enforced.&lt;/P&gt;</description>
      <pubDate>Fri, 07 Oct 2016 17:33:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234268#M45657</guid>
      <dc:creator>botkindl</dc:creator>
      <dc:date>2016-10-07T17:33:15Z</dc:date>
    </item>
    <item>
      <title>Re: What happens to the data if the indexer in an indexer cluster goes down?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234269#M45658</link>
      <description>&lt;P&gt;There are also extensive docs on this subject, see &lt;A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Whathappenswhenaslavenodegoesdown"&gt;What happens when a peer node goes down&lt;/A&gt; in the &lt;EM&gt;Managing Indexers and Clusters of Indexers&lt;/EM&gt; manual.&lt;/P&gt;

&lt;P&gt;See also:&lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt;&lt;A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Whathappenswhenapeercomesbackup"&gt;What happens when a peer node comes back up&lt;/A&gt;&lt;/LI&gt;
&lt;LI&gt;&lt;A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Whathappenswhenamasternodegoesdown"&gt;What happens when the master node goes down&lt;/A&gt;&lt;/LI&gt;
&lt;/UL&gt;</description>
      <pubDate>Fri, 07 Oct 2016 17:41:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234269#M45658</guid>
      <dc:creator>ChrisG</dc:creator>
      <dc:date>2016-10-07T17:41:33Z</dc:date>
    </item>
    <item>
      <title>Re: What happens to the data if the indexer in an indexer cluster goes down?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234270#M45659</link>
      <description>&lt;P&gt;Thanks Chris&lt;/P&gt;</description>
      <pubDate>Fri, 07 Oct 2016 21:55:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234270#M45659</guid>
      <dc:creator>sreejith2k2</dc:creator>
      <dc:date>2016-10-07T21:55:34Z</dc:date>
    </item>
    <item>
      <title>Re: What happens to the data if the indexer in an indexer cluster goes down?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234271#M45660</link>
      <description>&lt;P&gt;Thanks botkindl&lt;/P&gt;</description>
      <pubDate>Fri, 07 Oct 2016 21:56:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/What-happens-to-the-data-if-the-indexer-in-an-indexer-cluster/m-p/234271#M45660</guid>
      <dc:creator>sreejith2k2</dc:creator>
      <dc:date>2016-10-07T21:56:28Z</dc:date>
    </item>
  </channel>
</rss>

