Deployment Architecture

How to migrate from an indexer clustering to a standalone environment?

sidekix24
Path Finder

Weird question, but does anyone have a graceful procedure to go from clustered environment to stand alone?

Current setup:

1 master node
2 indexers clustered
1 stand alone search head

Company wants to go with:
2 search heads and 1 indexers to prepare for a multisite cluster down the road. Master Node will just sit idle for now. I know there's an "offline" command that we can run to take out the indexer from the cluster and then just need to re-point the search head to the correct peer, but I wanted to see if there's a graceful way to do this or if I'm going to run into any issues using the steps above.

thanks

0 Karma

Masa
Splunk Employee
Splunk Employee

If you're going to have multi-site Clustering, why do you need to make it non-Indexer Clustering env?

Probably the following steps would work. I strongly recommend to test it in a test env before trying it if possible.

  1. Change CM's RF and SF to 1
  2. Restart CM
  3. Remove excess buckets to make sure only one copy per bucket
  4. Stop CPs(Indexers) and remove Clustering settings
  5. Move apps from etc/slave-apps to etc/apps
  6. Start the Indexers
  7. Stop SH and remove clustering configurations
  8. Start SH and add those indexers as Search Peers from Splunkweb
  9. Stop CM
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...