Deployment Architecture

Add non-clustered indexer and standalone search head to existing cluster

splunkreal
Motivator

Hello,
we had standalone search head and indexer in a pre-production environment then I created new clustered environment with 2 sh and 2 idx.

I want to add those old non-clustered search head and indexer, could you let me know the right commands/procedures to add them to the existing cluster? Do I need to remove all Splunk instances and reinstall from scratch?

I understand old non-clustered data may be removed but this is not a problem as mostly frozen.

Thanks for your help.

* If this helps, please upvote or accept solution 🙂 *
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Only brand-new Splunk instances should be added to a SH cluster.  Once the cluster is built you can copy custom apps and user artifacts from the old SH (via the SHC Deployer).

Assuming you have enough disk space, yes you should be able to increase the RF/SF settings.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There's a manual for that.  See https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Migratenon-clusteredindexerstoaclustered...

---
If this reply helps you, Karma would be appreciated.

splunkreal
Motivator

Thanks Rich, what about the search head? I read it should be clean?

I think reinstalling totally Splunk on both of them is recommended?

May I be able to safely switch RF/SF from 2 to 3 afterwards?

Thanks for your help.

 

* If this helps, please upvote or accept solution 🙂 *
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Only brand-new Splunk instances should be added to a SH cluster.  Once the cluster is built you can copy custom apps and user artifacts from the old SH (via the SHC Deployer).

Assuming you have enough disk space, yes you should be able to increase the RF/SF settings.

---
If this reply helps you, Karma would be appreciated.

splunkreal
Motivator

Thanks Rich, adding new SH with "splunk init shcluster-config -replication_factor 2" ? or I can directly use -replication_factor 3 then update other SH with same value?

By the way I think this is confusing with [clustering] replication_factor, it should be have named search_artifacts_factor or similar 🤔

 

Doc server.conf: [shclustering]

replication_factor = <positive integer>
* Determines how many copies of search artifacts are created in the cluster.
* This must be set to the same value on all members.
* Default: 3

 

Regarding search_factor & replication_factor for manager node I may keep SF=2 and RF=2 as pre-production environment.

Thanks 🤗

* If this helps, please upvote or accept solution 🙂 *
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I would add the new SH using the same RF as the rest of the cluster.  You can increase the RF later.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...