Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

How is it possible to move indexers to different site in same cluster

New Member

I had 6 indexers in a cluster in 2 sites A and B. One of the admins(through scripting) configured 6 more indexers but accidentally added them all to site A instead of distributing them evenly(this was 2 weeks ago so there is lots of data on them already).

To distribute them evenly - 6 in site A and 6 in site B - is this as simple as:

  • enable maintenance mode
  • change the site in server.conf to the 3 I want moved to site B
  • disable maintenance mode
  • rebalance?

It seems too easy so I am hesitant.

We run the sites as such:
multisite = true
replication_factor = 2
site_replication_factor = origin:1,siteA:1,siteB:1,total:2
site_search_factor = origin:1,siteA:1,siteB:1,total:2

0 Karma


It's a little more involved than that. The process is documented at It describes a physical move to a different location, but the concept is the same.

If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!