Deployment Architecture

Migration of buckets from an non clustered instance to a clustered instance


Hi guys,

I have the following issue, I have copied the whole $SPLUNK_HOME directory from my old Splunk instance to both of my indexers which are part of the cluster I want to set up. After changing the guid in the $SPLUNK_HOME/etc/instance.cgf file, one of the indexer is not fully searchable and therefore can't be added to the cluster as all the buckets I have imported are standalone buckets.
Is it mandatory to precise the guid on the imported buckets as both of the indexers already have it ?

Do you guys know of a solution to fix the problem and avoid renaming the buckets ? I have a lot of indexes and buckets, so this solution is not foreseeable.

0 Karma

Splunk Employee
Splunk Employee

you should only have a single copy of the buckets from non-clustered splunk installs. we don't replicate your old pre-clustering buckets, so we don't expect there to be more than one copy (which is likely why the second peer wasn't allowed to add itself to the cluster).

if you want to make your old pre-clustering buckets clustered (and replicated), see

Path Finder

Best thing to do is to move them onto the thawed path and manually delete them when the time comes, keeping them in the default path can be tricky to get working, where as thawed it will usually be fine.
We are having the same issue moving from standalone indexers to clustered indexers, we did the above and let it ride until our retention period was complete.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...