Deployment Architecture

How to migrate from an indexer clustering to a standalone environment?

sidekix24
Path Finder

Weird question, but does anyone have a graceful procedure to go from clustered environment to stand alone?

Current setup:

1 master node
2 indexers clustered
1 stand alone search head

Company wants to go with:
2 search heads and 1 indexers to prepare for a multisite cluster down the road. Master Node will just sit idle for now. I know there's an "offline" command that we can run to take out the indexer from the cluster and then just need to re-point the search head to the correct peer, but I wanted to see if there's a graceful way to do this or if I'm going to run into any issues using the steps above.

thanks

0 Karma

Masa
Splunk Employee
Splunk Employee

If you're going to have multi-site Clustering, why do you need to make it non-Indexer Clustering env?

Probably the following steps would work. I strongly recommend to test it in a test env before trying it if possible.

  1. Change CM's RF and SF to 1
  2. Restart CM
  3. Remove excess buckets to make sure only one copy per bucket
  4. Stop CPs(Indexers) and remove Clustering settings
  5. Move apps from etc/slave-apps to etc/apps
  6. Start the Indexers
  7. Stop SH and remove clustering configurations
  8. Start SH and add those indexers as Search Peers from Splunkweb
  9. Stop CM
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...