If I have more Indexes on one Peer Node in a cluster than the other, how can I rebalance them?

[Gregski11]

so in a simple four Splunk server test lab setup I have one Cluster Master, two Indexers, and one Deployment Server

before I knew how to create indexes properly in a clustered peer environment (ie using the indexes.conf file and pushing it as a bundle via the Cluster Master) I created a couple indexes locally via the Web Console on Indexer1 how do I replicate those to Indexer2 now?

Please and thank you,

G

[gcusello]

Hi @Gregski11,

it's not possible to replicate already indexed data,

You have two choices to have them in a cluster:

• to reindex them again after creating clustered indexes;
• to manually copy them in the other indexers (data and indexes.conf).

Obviously, in the second case they aren't clustered so they cannot receive new data and remain until retention; I used this solution when I had old indexed data so I copied the old indexes in all the clustered indexers and I created clustered indexes for the new data with different names.

Ciao.

Giuseppe