Deployment Architecture

If I have more Indexes on one Peer Node in a cluster than the other, how can I rebalance them?

Gregski11
Explorer

so in a simple four Splunk server test lab setup I have one Cluster Master, two Indexers, and one Deployment Server

before I knew how to create indexes properly in a clustered peer environment (ie using the indexes.conf file and pushing it as a bundle via the Cluster Master) I created a couple indexes locally via the Web Console on Indexer1 how do I replicate those to Indexer2 now?

Please and thank you,

G

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Gregski11,

it's not possible to replicate already indexed data,

You have two choices to have them in a cluster:

  • to reindex them again after creating clustered indexes;
  • to manually copy them in the other indexers (data and indexes.conf).

Obviously, in the second case they aren't clustered so they cannot receive new data and remain until retention; I used this solution when I had old indexed data so I copied the old indexes in all the clustered indexers and I created clustered indexes for the new data with different names.

Ciao.

Giuseppe

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!