Getting Data In

Can I build an indexer cluster with a single indexer and migrate the second indexer in later?

conner9
Path Finder

I currently have a single Splunk server doing everything. I would like to move to a clustered environment. I have a second matching machine and a couple of smaller systems that should allow me to put the rest of a clustered environment together.

My question is: Will a clustered environment work with a single indexer while I get the pieces functioning properly?

I do understand that replication will not function until the second indexer is added to the cluster.

Thanks,

0 Karma
1 Solution

lukas_loder
Communicator

During the Classes at Splunk they told us it is possible to have one indexer alone in a cluster. And they even reccomended it.

Becaue it isn't slower at all. It just changes how it stores the data. And as soon as you are going to bring a second indexer into the cluster, all the data will get synct. (From that moment on when you started the cluster with one indexer)

If you haven't conifgured the cluster bevore, old data will not be synct.

But i haven't tried it by my self. I'm just saying, what the reccomended us at Splunk .conf2015

View solution in original post

dxu_splunk
Splunk Employee
Splunk Employee

normally, a splunk cluster will wait until RF # of indexers have been added to a cluster before indexing (and other activity) starts up.

you can use the "set indexing-ready" command to bypass this with a single indexer in a cluster.

splunk set indexing-ready

see http://answers.splunk.com/answers/209141/why-am-i-getting-error-indexing-not-ready-fewer-th.html

conner9
Path Finder

thanks for pointing this out!!

0 Karma

lukas_loder
Communicator

During the Classes at Splunk they told us it is possible to have one indexer alone in a cluster. And they even reccomended it.

Becaue it isn't slower at all. It just changes how it stores the data. And as soon as you are going to bring a second indexer into the cluster, all the data will get synct. (From that moment on when you started the cluster with one indexer)

If you haven't conifgured the cluster bevore, old data will not be synct.

But i haven't tried it by my self. I'm just saying, what the reccomended us at Splunk .conf2015

mahamed_splunk
Splunk Employee
Splunk Employee

Yes, i understand what they recommended in the class. If you start with clustering and when you have the additional indexers, the old data will be replicated. If you add clustering option later, then old data will not get replicated.

This approach will work, although you will be better of having both the machines available from the start. The other thing to consider is the time gap between the addition of new machines. If it is few days is one thing, if it is few months then the replication traffic to catch up the old data might saturate your network.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

What's the point? Why not configure clustering once you have at least two indexers available and use a simple distributed search setup now?
I can't think of any good reason why a single node cluster can not be configured, as long as you have at least three servers available:
- A cluster Search Head
- A cluster master
- A cluster peer node (indexer)

You would have to set the replication_factor to 1 and the search_factor to 1.
I am not sure what value that would have, because pretty much no cluster functionality will be available.

As long as you meet the requirements documented here, it should work.

0 Karma

conner9
Path Finder

The thought was to greenfield the deployment and get the distributed functions working without impacting the current online system. The current system still has some older cruft that has accumulated since as far back as the 4.3 days. Also, I would hate to make a mistake and cause my users problems while figuring out what I've done wrong. My deployment isn't huge, we're mostly trying to make it redundant, less than 50gb a day now and only a couple of TB archived.

Thanks for the response.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...