Moving from a single indexer/search head to indexer clustering, does the master node have to be a separate server, or can I use the deployment server?

[hagjos43]

Good morning.

We are (finally) looking to upgrade and add a second indexer in the mix. Our current setup is the following:
Searchhead x 1
Indexer x 1
Deployment Server x 1

We want to do single site indexer clustering with full redundancy between both indexers, as well as decreased search time (spreading a search across multiple indexers). From what I'm reading here we must identify a master node. My question is, does this have to be a separate server or can I use the deployment server as the master node? Are there any best practices, or additional guides anyone would advise using?

Many thanks
- Joe

[srisahitya_v]

if you want to make indexer clustering, then set 3 indexes is a best practice. 2 search heads help to get rid of single-point fail over.
then you should have a master node.
you can use deployment server as master node.
please find the link below.

• http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Clusterdeploymentoverview

[jeffland · Accepted solution]

You can use the deployment server for that, up to a certain indexed volume and number of indexers the master node does not require that many resources. See here for the official docs on that.

[hagjos43]

I configured the master server and indexers with a replication factor of 2. The indexes did not replicate already indexed data. Is there a way to replicate previously indexed data, or is it ONLY data from the date replication is enabled and future data?

Thanks

[jeffland]

That is possible, but not recommended.

If your license allows and you really need the data clustered, you could also re-index it.

[hagjos43]

so there is no automatic way to do this?

Here is our situation. We need to take down server 1 for maintenance and many other things (will be down for up to a week). We want a second indexer added (indexer clustering) so that during the downtime users can still search historical data. The new indexer will receive data during down time.

When the maintenance is complete we will bring the server (original indexer) back up and add it back to the mix. From that point forward we will have two indexers in a cluster.

FYI - The forwarders will be configured to send data to both indexers.

[jeffland]

In that case, you could simply move your already indexed data as it is to the new machine - but be careful to follow the instructions.

[hagjos43]

If I want the indexes to be replicated from indexer1 to indexer2 should replication factor be set to 2?

within the master indexes.conf I have it set to:

[indexnamegoeshere]
repFactor=auto

[jeffland]

You set the replication factor when you set the cluster up. I would recommend you do it via the GUI if this you first time doing it.