I have a single site cluster that architecture is as follows:
search header cluster: 4 search head + a deployer
indexer cluster : 5 peer node + 1 master node
1、I don't want to use search header clustering now. I want to change the architecture to a single search instance . What should I do?
I want to change to :
a search head and no deployer
indexer cluster : 3 peer node + 1 master node
https://docs.splunk.com/Documentation/Splunk/7.2.3/DistSearch/Removeaclustermember
https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Removepeerfrommasterlist
Do I just need to remove 3 cluster members from SHC and remove 2 peer node from indexer cluster with reference to the above document? ?
I have been unable to find specific documentation about this scenario, but I think this process should work:
etc/system/local/server.conf
and comment out the [shclustering]
section and [replication_port:..
sections.Yes you can convert to a single indexer if you have enough storage space. You can use the instructions here: https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Takeapeeroffline#Take_a_peer_down_permane...
I have been unable to find specific documentation about this scenario, but I think this process should work:
etc/system/local/server.conf
and comment out the [shclustering]
section and [replication_port:..
sections.Yes you can convert to a single indexer if you have enough storage space. You can use the instructions here: https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Takeapeeroffline#Take_a_peer_down_permane...
The last question , can I convert an indexer cluster to an indexer? At present, the search factor is 2 and the replication factor is 3, which means that the indexer keeps two searchable copies. If I remove multiple peers from the indexer, if I guarantee that an indexer's data is complete?How can I do this without loss and repetition?
Hi, You cannot have a SF or RF of more than 1 if you only have one indexer. You would need to keep at least 3 indexers. Otherwise reduce your SF/RF first.
@chrisyoungerjds thank you for your reply. now ,I want to convert to 1 search head + indexer cluster with 3 peer nodes+1 master node. According to the above method, can I really do it? Now replication factor 3, the search factor is 2. If I convert, should the replication factor be changed to 2 and the search factor changed to 1?
You need to have as many indexers as you have SF/RF. So if you have SF2/RF2 then you only need two indexers. If you have SF1/RF2 then you need two indexers still. If you have SF1/RF2 and one indexer dies, you won't lose data but you will need to spend time rebuilding the indexes. How long this takes depends on how much data you have. I hope this helps.