Deployment Architecture

How to forward indexed data to another splunk indexer cluster ?

Explorer

We have a Indexer Cluster And Search Head Cluster. We need to send all data in a standalone Splunk instance to the indexer cluster without merging this instance in the indexer cluster.

0 Karma

Path Finder

Are you trying to decommission the standalone? Could you allow the data to be aged off gracefully without adding new data to the standalone? If so, you could just add the standalone as a search peer and let the retention period expire. This way, you are not having to move the data over.

Also if you migrate the buckets over by copying all of them, I am not sure they would replicate to the other indexers in the cluster.

0 Karma

Motivator

Hey@mibrahim8,

Please refer this link below:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex

Let me know if this helps!!

0 Karma

Explorer

The Stand alone splunk instance is totally separated from the indexer cluster. So, the exactly needed to migrate the indexed data in this separated splunk standalone instance to the indexer cluster. But the topic mentioned in the Doc.s is to change the directory of the indexed data in the same indexer.

Motivator

You can move the buckets in the specific index to one of the indexers in cluster in the same index path .
Make sure the indexer in cluster is stopped before moving this data and once the indexer is started the data will be searchable and also the replication will be taken care-of.

0 Karma

New Member

I'm not 100% sure, but I don't think the data will be replicated before the buckets has the GUID from the peer in the cluster that now has the data. http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/HowSplunkstoresindexes#Bucket_names

0 Karma

Motivator
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!