Deployment Architecture

Migrate from single-site indexer cluster to multi-site

GenRockeR
Explorer

Hi guys.

I had a single-site indexer cluster with replication_factor 3. Migrated to multisite cluster with parameters:
site_replication_factor = origin:2,total:3
site_search_factor = origin:1,total:2
constrain_singlesite_buckets = false

After migrate I've 4 replicated bucket copies: 3 in old site and 1 in new site. I already add some configuration manually like this
search_factor = 2
replication_factor = 2

But there are still 3 copies in the old cluster.
What can I do to remove the extra data from the cluster?

Splunk Enterprise
Version:
7.2.1
Build:
be11b2c46e23

0 Karma

dxu_splunk
Splunk Employee
Splunk Employee
0 Karma

dxu_splunk
Splunk Employee
Splunk Employee
0 Karma

GenRockeR
Explorer

No results.

Splunk Atom Feed: clustermasterbuckets
Updated: 2019-02-13T16:02:37+03:00 Splunk build: 7.2.1
Feed links: create - _acl -

0 Karma

GenRockeR
Explorer
splunk_server   currentDBSizeGB maxTotalDataSizeGB  totalEventCount eai:acl.app

1 splunk-idx11 384 500 2571516578 _cluster
2 splunk-idx12 272 500 1827380397 _cluster
3 splunk-idx13 419 500 2893046932 _cluster
4 splunk-idx20 68 500 521531899 _cluster
5 splunk-idx21 72 500 566775305 _cluster
6 splunk-idx22 71 500 552783442 _cluster
7 splunk-idx23 77 500 611006777 _cluster
8 splunk-idx24 77 500 602144046 _cluster
9 splunk-idx25 67 500 524328395 _cluster
10 splunk-idx26 70 500 549058168 _cluster
11 splunk-idx27 75 500 589072469 _cluster
12 splunk-idx28 63 500 488439975 _cluster
13 splunk-idx29 67 500 516032474 _cluster

0 Karma

GenRockeR
Explorer

I have already used this commands but I still have extra copies. Why I still have 3 copies in old part of single-site indexer cluster
(site1) and new replicated copies in site2?

0 Karma
Get Updates on the Splunk Community!

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...