Deployment Architecture

Migrate from single-site indexer cluster to multi-site

Explorer

Hi guys.

I had a single-site indexer cluster with replication_factor 3. Migrated to multisite cluster with parameters:
site_replication_factor = origin:2,total:3
site_search_factor = origin:1,total:2
constrain_singlesite_buckets = false

After migrate I've 4 replicated bucket copies: 3 in old site and 1 in new site. I already add some configuration manually like this
search_factor = 2
replication_factor = 2

But there are still 3 copies in the old cluster.
What can I do to remove the extra data from the cluster?

Splunk Enterprise
Version:
7.2.1
Build:
be11b2c46e23

0 Karma

Splunk Employee
Splunk Employee
0 Karma

Splunk Employee
Splunk Employee
0 Karma

Explorer

No results.

Splunk Atom Feed: clustermasterbuckets
Updated: 2019-02-13T16:02:37+03:00 Splunk build: 7.2.1
Feed links: create - _acl -

0 Karma

Explorer
splunk_server   currentDBSizeGB maxTotalDataSizeGB  totalEventCount eai:acl.app

1 splunk-idx11 384 500 2571516578 _cluster
2 splunk-idx12 272 500 1827380397 _cluster
3 splunk-idx13 419 500 2893046932 _cluster
4 splunk-idx20 68 500 521531899 _cluster
5 splunk-idx21 72 500 566775305 _cluster
6 splunk-idx22 71 500 552783442 _cluster
7 splunk-idx23 77 500 611006777 _cluster
8 splunk-idx24 77 500 602144046 _cluster
9 splunk-idx25 67 500 524328395 _cluster
10 splunk-idx26 70 500 549058168 _cluster
11 splunk-idx27 75 500 589072469 _cluster
12 splunk-idx28 63 500 488439975 _cluster
13 splunk-idx29 67 500 516032474 _cluster

0 Karma

Explorer

I have already used this commands but I still have extra copies. Why I still have 3 copies in old part of single-site indexer cluster
(site1) and new replicated copies in site2?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!