How do I cluster a new index server with my production index server?

[molinarf]

I have one indexer and would like to add another indexer for redundancy. Is it possible to cluster the two together and have the data replicated. Also, once the cluster is functioning what would happen if I take down the master? I would like to be able to answer that question because we are currently working towards a fail over plan.

I currently have one indexer which is doubles as a search head and a second indexer at another site that forwards data to the first indexer. I want to add a new indexer that would replicate with the first indexer.

Eventually, I would like to take down the first indexer and have the new indexer be the primary indexer then I will build a new one that is virtual.

I hope that is clear enough.

Thank you,
Robert

[molinarf]

Based on what you said and everything I read, it would be best that I don't cluster to migrate. If I migrate to a new server can I copy the buckets across to it to replicate? After that, I can then stand up the virtual server that I wanted to so that I can cluster off that. I. I understand that once I cluster that I shouldn't return back to a standalone. I don't think I will because the goal is to have resiliency.

Robert

[esix_splunk · Accepted solution]

The short answer to your questions are as follows:

You can have a cluster configuration, and it will replicate the buckets. However, it will not replicate historical data, only the data from the time you enable clustering and bring up the required peers to meet the search and replication factor. There is no concept of a primary indexer, data is balanced across the cluster. The only thing that is added is the Cluster Master role.

If you are wanting to migrate to a new indexer, you're better not to use clustering as a way to build and replicate data. Things can get tricky if you try to migrate from Clustered back to standalone.

Read here : http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters