How to forward indexed data to another splunk indexer cluster ?

[mibrahim8]

We have a Indexer Cluster And Search Head Cluster. We need to send all data in a standalone Splunk instance to the indexer cluster without merging this instance in the indexer cluster.

[robgora_deloitt]

Are you trying to decommission the standalone? Could you allow the data to be aged off gracefully without adding new data to the standalone? If so, you could just add the standalone as a search peer and let the retention period expire. This way, you are not having to move the data over.

Also if you migrate the buckets over by copying all of them, I am not sure they would replicate to the other indexers in the cluster.

[deepashri_123]

Hey@mibrahim8,

Please refer this link below:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex

Let me know if this helps!!

[mibrahim8]

The Stand alone splunk instance is totally separated from the indexer cluster. So, the exactly needed to migrate the indexed data in this separated splunk standalone instance to the indexer cluster. But the topic mentioned in the Doc.s is to change the directory of the indexed data in the same indexer.

[deepashri_123]

You can move the buckets in the specific index to one of the indexers in cluster in the same index path .
Make sure the indexer in cluster is stopped before moving this data and once the indexer is started the data will be searchable and also the replication will be taken care-of.

[kentaage]

I'm not 100% sure, but I don't think the data will be replicated before the buckets has the GUID from the peer in the cluster that now has the data. http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/HowSplunkstoresindexes#Bucket_names

[splunker12er]

check this link :

https://answers.splunk.com/answers/399009/how-to-migrate-buckets-from-a-standalone-indexer-t.html