How is it possible to move indexers to different site in same cluster

[bfarr]

I had 6 indexers in a cluster in 2 sites A and B. One of the admins(through scripting) configured 6 more indexers but accidentally added them all to site A instead of distributing them evenly(this was 2 weeks ago so there is lots of data on them already).

To distribute them evenly - 6 in site A and 6 in site B - is this as simple as:

• enable maintenance mode
• change the site in server.conf to the 3 I want moved to site B
• disable maintenance mode
• rebalance?

It seems too easy so I am hesitant.

We run the sites as such:
multisite = true
replication_factor = 2
site_replication_factor = origin:1,siteA:1,siteB:1,total:2
site_search_factor = origin:1,siteA:1,siteB:1,total:2

[richgalloway]

It's a little more involved than that. The process is documented at https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Moveapeertoanewsite. It describes a physical move to a different location, but the concept is the same.