We are running Splunk on Windows and are moving from a multisite cluster with two sites to a single site. Are there any detrimental effects from leaving the cluster master in multisite mode even though only one site is configured? We would like to avoid the down time required to switch to single site mode if possible.
Hi
probably you could try this https://docs.splunk.com/Documentation/Splunk/8.2.1/Indexer/Decommissionasite
But better option is this https://docs.splunk.com/Documentation/Splunk/8.2.1/Indexer/Converttosinglesite if you have only one site after migration.
r. Ismo