Deployment Architecture

How to migrate from an indexer clustering to a standalone environment?

sidekix24
Path Finder

Weird question, but does anyone have a graceful procedure to go from clustered environment to stand alone?

Current setup:

1 master node
2 indexers clustered
1 stand alone search head

Company wants to go with:
2 search heads and 1 indexers to prepare for a multisite cluster down the road. Master Node will just sit idle for now. I know there's an "offline" command that we can run to take out the indexer from the cluster and then just need to re-point the search head to the correct peer, but I wanted to see if there's a graceful way to do this or if I'm going to run into any issues using the steps above.

thanks

0 Karma

Masa
Splunk Employee
Splunk Employee

If you're going to have multi-site Clustering, why do you need to make it non-Indexer Clustering env?

Probably the following steps would work. I strongly recommend to test it in a test env before trying it if possible.

  1. Change CM's RF and SF to 1
  2. Restart CM
  3. Remove excess buckets to make sure only one copy per bucket
  4. Stop CPs(Indexers) and remove Clustering settings
  5. Move apps from etc/slave-apps to etc/apps
  6. Start the Indexers
  7. Stop SH and remove clustering configurations
  8. Start SH and add those indexers as Search Peers from Splunkweb
  9. Stop CM
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...