We are (finally) looking to upgrade and add a second indexer in the mix. Our current setup is the following:
Searchhead x 1
Indexer x 1
Deployment Server x 1
We want to do single site indexer clustering with full redundancy between both indexers, as well as decreased search time (spreading a search across multiple indexers). From what I'm reading here we must identify a master node. My question is, does this have to be a separate server or can I use the deployment server as the master node? Are there any best practices, or additional guides anyone would advise using?
if you want to make indexer clustering, then set 3 indexes is a best practice. 2 search heads help to get rid of single-point fail over.
then you should have a master node.
you can use deployment server as master node.
please find the link below.
I configured the master server and indexers with a replication factor of 2. The indexes did not replicate already indexed data. Is there a way to replicate previously indexed data, or is it ONLY data from the date replication is enabled and future data?
so there is no automatic way to do this?
Here is our situation. We need to take down server 1 for maintenance and many other things (will be down for up to a week). We want a second indexer added (indexer clustering) so that during the downtime users can still search historical data. The new indexer will receive data during down time.
When the maintenance is complete we will bring the server (original indexer) back up and add it back to the mix. From that point forward we will have two indexers in a cluster.
FYI - The forwarders will be configured to send data to both indexers.
If I want the indexes to be replicated from indexer1 to indexer2 should replication factor be set to 2?
within the master indexes.conf I have it set to: