How to suppress replication in one of the peer nodes

[hitesh_pawar]

Hi all,

I have a simple CLuster consfiguration where M1 is master, S1 is Search Head and P1, P2 and P3 are three peers with a replication factor of 2. My requirment is that peer P3 should not take part in replication process. The replication should take plase across P1 and P2 only.
P3 is added so that its data can be searched in existing Cluster Search Head.
Can any one tell me how can I supress replication in P3.

Regards
Hitesh

[mahamed_splunk · Accepted solution]

You can remove P3 from cluster and add it back as a non-clustered indexer. The search head can search both clustered and non-clustered indexers.

It's documented here

http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Configurehybridsearch

[hitesh_pawar]

Yes I agree with Mahamed. I removed it from the Cluster and was able to search its data in Cluster Search Head

-Hitesh

[hitesh_pawar]

Yes,P3 is already having some data. But my requirement is:

1) P3 data should not get replicated in P1 and P2.
2) P1 and P2 data should not get replicated in P3.
Is there any way we can configure P3 to exhibit above behaviour.
Best Regards
Hitesh

[martin_mueller]

I didn't test this, but you might be able to take P3 out of the cluster and add it as a distributed search peer to your search head.

If it's part of the cluster it will eventually participate in replication... that's the point of being in a cluster.

[sowings]

So P3 already has some sort of data, but you need to search it simultaneously while searching the clustered data?