Is there a document for best practices in decommissioning an indexer (IDX) cluster?

[rbal_splunk]

Is there a document for best practices in decommissioning an IDX cluster?

We are going back to stand alone indexers. I found this one, but it doesn’t seem to fit their request. http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Decommissionasite

[rbal_splunk · Accepted solution]

The issue would be duplicate data that would be returned when just converting back to standalone indexers. you can try something like:

1) on the cluster, set replication_factor=1, search_factor=1. restart CM
2) roll the existing hot buckets on all the indexers, so all hot buckets have only a single copy
3) run remove_excess_buckets to "dedup" the cluster
4) convert to standalone indexers (edited)