Deployment Architecture

How to migrate from an indexer clustering to a standalone environment?

sidekix24
Path Finder

Weird question, but does anyone have a graceful procedure to go from clustered environment to stand alone?

Current setup:

1 master node
2 indexers clustered
1 stand alone search head

Company wants to go with:
2 search heads and 1 indexers to prepare for a multisite cluster down the road. Master Node will just sit idle for now. I know there's an "offline" command that we can run to take out the indexer from the cluster and then just need to re-point the search head to the correct peer, but I wanted to see if there's a graceful way to do this or if I'm going to run into any issues using the steps above.

thanks

0 Karma

Masa
Splunk Employee
Splunk Employee

If you're going to have multi-site Clustering, why do you need to make it non-Indexer Clustering env?

Probably the following steps would work. I strongly recommend to test it in a test env before trying it if possible.

  1. Change CM's RF and SF to 1
  2. Restart CM
  3. Remove excess buckets to make sure only one copy per bucket
  4. Stop CPs(Indexers) and remove Clustering settings
  5. Move apps from etc/slave-apps to etc/apps
  6. Start the Indexers
  7. Stop SH and remove clustering configurations
  8. Start SH and add those indexers as Search Peers from Splunkweb
  9. Stop CM
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...