How to copy already indexed data to the new indexer in multisite indexer clustered environment?

[sudeshgaur]

I have two sites in my multisite clustered environment. On site 1, I have 4 indexers, and on site -2 I have 1 indexer. On site 2, I am planning to decommission the current peer node (indexer) and add two new peer nodes (indexers).
How can I copy/replicate already indexed data to new peer nodes (indexers) without any downtime, and what is the best way to copy the old data?

[DalJeanis]

Since you are decommissioning the old indexer, the right search term to find relevant articles and questions is "move index" or "migrate index". The down time is not major, since you are not actually re-indexing the data, just copying the indexes and the data to the equivalent location, changing the environmental variables, and then starting it in the new place.

It might simplify and speed the migration to move it to the new cluster with only one indexer running there, then after validating, you can bring up the second and engage any replication on the cluster. (But then, I'm a belt-and-suspenders-and-duct-tape kind of guy.)

Here's the documentation...

https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Moveanindex

And here's some other relevant results...

https://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk...
https://answers.splunk.com/answers/32176/is-it-possible-to-migrate-indexed-buckets-to-a-different-in...