How to replicate non clustered buckets to clustered data

[bapun18]

Hi we wanted to migrate standalone indexer  to multisite cluster, with 2 site.

Below are my questions

1. Can I find out all files meaning all data bickets and add GUID by a script to all db files or we will include all rb files as reqired and if we will do the same what are the risk associated with it.

2. with a site replication factor of 2:1, if I will copy the nonclustered  data to 2 indexers one in site1 and one in site2 to make it high availability will it work, so that if one indexer goes down other will have data. If answer is yes, any risk associated with it.

[PickleRick · Accepted solution]

I already answered this on Slack so I'll repost my answer here for future reference.

1) The bucket renaming operation is a bit tricky so it's indeed supposed to be done by PS or a Consultant but is not very "dangerous". You just have to know what you're doing.

2) The way to go (as I understand you're not converting an existing standalone indexer to a clustered one but spining up a completely new clustered environment and want to move existing data data from the old one) would be to rename the buckets so that they are recognized as clustered, then make one copy of each bucket into the new environment and let the cluster do the fixups and replicate the missing copies. (You need to configure the cluster with 

constrain_singlesite_buckets=false

If you just copied non-clustered buckets across your clustered environment each copy would be treated as a single non-clustered bucket and would be searched separately (and you'd get multuple results from your searches).

[gcusello]

Hi @bapun18 ,

this activity should be performed only by Splunk PS and it is part of the Splunk Consultant training.

Ciao.

Giuseppe