topic Re: Is it really required to stop indexer services while adding another indexer? in Getting Data In

Is it really required to stop indexer services while adding another indexer?

ramesh12345 — Tue, 13 Nov 2018 09:48:05 GMT

I have one machine which is acting as an indexer as well as a search head. So, i want to add another indexer. So what is the procedure to do this and also what configurations files do I need to copy from the previous indexer?

Please help me.

Re: Is it really required to stop indexer services while adding another indexer?

nilbak1 — Tue, 13 Nov 2018 15:07:36 GMT

Hi @ramesh12345
I assumed this as non-clustered indexer. What you have to do here is:

Install Splunk Enterprise on the new server,
add to your search head a new search peer [Settings -- Distributed Search -- Search peer] and you are done
Modify outputs.conf of your forwarders and add this new indexer as well.

Hope, it clears your doubts.

Re: Is it really required to stop indexer services while adding another indexer?

ramesh12345 — Tue, 13 Nov 2018 15:19:33 GMT

Thank you very much for your reply @nilbak1. I have some other doubts is it really mandatory to copy indexes.conf to new indexer machine?

Re: Is it really required to stop indexer services while adding another indexer?

Steve_G_ — Tue, 13 Nov 2018 17:37:44 GMT

You will probably want to copy the indexes.conf file over, to ensure that both indexers use the same settings. For example, assuming that the forwarders will be load balancing across both indexers, you'll need the same set of custom indexes on both indexers.

Re: Is it really required to stop indexer services while adding another indexer?

ramesh12345 — Wed, 14 Nov 2018 08:45:13 GMT

Thank you Steve for your response.