Deployment Architecture

Are all indexes replicated in Indexer cluster?

scottrunyon
Contributor

I am currenly running a 2 system indexing cluster on Windows VMs. One of the systems is experiencing poor performance causing my search head to run slowly. What I want to do is configure a new VM, install a fresh Splunk Enterprise application and move all incoming data to this new system and bypass the old indexer. With the replication going on between the indexers in this cluster, can I shut down the slow indexer and not lose and indexed data?

If this is not feasible, is there a way to migrate the data from the old system to the new one?

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

The buckets on the slow indexer will have a guid specific to that indexer in their filenames. That data will not replicate to the new indexer unless you increase the replication factor after adding the indexer. So you could do that, wait for everything to replicate, then shutdown the slow indexer and reduce your replication factor back to 2. You will need to be in normal operations mode for that to work, not maintenance mode.

IF for some reason that doesn't work, then the other option would be to clone the slow indexer to the new indexer, shut down the slow indexer, and re-ip the new indexer to the old ip of the slow indexer. This is probably the cleanest method IMHO.

Still I wonder why your slow indexer is slow... Does it have less cpu/memory or slow disk? Or is it a configuration issue. If it's a configuration issue the 2nd method above will not work.

View solution in original post

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...