Add non-clustered indexer and standalone search head to existing cluster

[splunkreal]

Hello,
we had standalone search head and indexer in a pre-production environment then I created new clustered environment with 2 sh and 2 idx.

I want to add those old non-clustered search head and indexer, could you let me know the right commands/procedures to add them to the existing cluster? Do I need to remove all Splunk instances and reinstall from scratch?

I understand old non-clustered data may be removed but this is not a problem as mostly frozen.

Thanks for your help.

[richgalloway]

There's a manual for that.  See https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Migratenon-clusteredindexerstoaclustered...

[splunkreal]

Thanks Rich, what about the search head? I read it should be clean?

I think reinstalling totally Splunk on both of them is recommended?

May I be able to safely switch RF/SF from 2 to 3 afterwards?

Thanks for your help.

[richgalloway · Accepted solution]

Only brand-new Splunk instances should be added to a SH cluster.  Once the cluster is built you can copy custom apps and user artifacts from the old SH (via the SHC Deployer).

Assuming you have enough disk space, yes you should be able to increase the RF/SF settings.

[splunkreal]

Thanks Rich, adding new SH with "splunk init shcluster-config -replication_factor 2" ? or I can directly use -replication_factor 3 then update other SH with same value?

By the way I think this is confusing with [clustering] replication_factor, it should be have named search_artifacts_factor or similar 🤔

Doc server.conf: [shclustering]

replication_factor = <positive integer>
* Determines how many copies of search artifacts are created in the cluster.
* This must be set to the same value on all members.
* Default: 3

Regarding search_factor & replication_factor for manager node I may keep SF=2 and RF=2 as pre-production environment.

Thanks 🤗

[richgalloway]

I would add the new SH using the same RF as the rest of the cluster.  You can increase the RF later.