We have two index clusters, one has 5 indexers (cluster 2) and the other had 100+ indexers (cluster 1).
We want to move the 5 indexers (physical servers) to the larger cluster (cluster 1) and disable the smaller cluster master (cluster 2). Is there any way to do this without moving each index separately.
All of our Search head clusters can currently see both index clusters.
We are on linux and Splunk 7.3.5 soon to upgrade to Splunk 8.