https://community.splunk.com/t5/Getting-Data-In/Lost-data-after-indexers-had-to-rebuild-in-an-indexer-cluster-Is/m-p/287876#M55011 <P>Phew - I'm glad it's not prod! I was worried for ya!</P> Tue, 02 Aug 2016 13:18:34 GMT lycollicott 2016-08-02T13:18:34Z https://community.splunk.com/t5/Getting-Data-In/Lost-data-after-indexers-had-to-rebuild-in-an-indexer-cluster-Is/m-p/287873#M55008 <P>I had to rebuild my two slave indexers, but the master is still intact. However, I lost all data prior to the rebuild. Does the master not maintain a copy of the data? If not, had I rebuilt one, and waited for data replication before rebuilding the second, would I have maintained the data?</P> <P>Also, how can I determine how long replication from one indexer to another is taking?</P> Thu, 28 Jul 2016 21:01:54 GMT https://community.splunk.com/t5/Getting-Data-In/Lost-data-after-indexers-had-to-rebuild-in-an-indexer-cluster-Is/m-p/287873#M55008 timmy13 2016-07-28T21:01:54Z https://community.splunk.com/t5/Getting-Data-In/Lost-data-after-indexers-had-to-rebuild-in-an-indexer-cluster-Is/m-p/287874#M55009 <P>Sorry Tim....the master only manages the slaves, so I really hope you were taking backups. If you had only rebuilt one of them AND if you had replicated data on the other one then yes it would have replicated once you re-added the rebuilt slave to the cluster. </P> <P>The replication time is trickier - it depends on index sizes, server horsepower, bandwidth and the phases of the moon. Splunk doesn't really provide anything for that which is very good in my opinion, but you can watch the progress of your fixup jobs on either the master or on a DMC if you have one setup.</P> <P>If you don't have any backups....well, you're screwed. Sorry, dude.</P> Fri, 29 Jul 2016 14:19:38 GMT https://community.splunk.com/t5/Getting-Data-In/Lost-data-after-indexers-had-to-rebuild-in-an-indexer-cluster-Is/m-p/287874#M55009 lycollicott 2016-07-29T14:19:38Z https://community.splunk.com/t5/Getting-Data-In/Lost-data-after-indexers-had-to-rebuild-in-an-indexer-cluster-Is/m-p/287875#M55010 <P>Fortunately this is not a production environment. So the loss of data is actually a good lesson learned for production. Thanks!</P> Mon, 01 Aug 2016 13:46:31 GMT https://community.splunk.com/t5/Getting-Data-In/Lost-data-after-indexers-had-to-rebuild-in-an-indexer-cluster-Is/m-p/287875#M55010 timmy13 2016-08-01T13:46:31Z https://community.splunk.com/t5/Getting-Data-In/Lost-data-after-indexers-had-to-rebuild-in-an-indexer-cluster-Is/m-p/287876#M55011 <P>Phew - I'm glad it's not prod! I was worried for ya!</P> Tue, 02 Aug 2016 13:18:34 GMT https://community.splunk.com/t5/Getting-Data-In/Lost-data-after-indexers-had-to-rebuild-in-an-indexer-cluster-Is/m-p/287876#M55011 lycollicott 2016-08-02T13:18:34Z