Getting Data In

How is it possible to move indexers to different site in same cluster

bfarr
Explorer

I had 6 indexers in a cluster in 2 sites A and B. One of the admins(through scripting) configured 6 more indexers but accidentally added them all to site A instead of distributing them evenly(this was 2 weeks ago so there is lots of data on them already).

To distribute them evenly - 6 in site A and 6 in site B - is this as simple as:

  • enable maintenance mode
  • change the site in server.conf to the 3 I want moved to site B
  • disable maintenance mode
  • rebalance?

It seems too easy so I am hesitant.

We run the sites as such:
multisite = true
replication_factor = 2
site_replication_factor = origin:1,siteA:1,siteB:1,total:2
site_search_factor = origin:1,siteA:1,siteB:1,total:2

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's a little more involved than that. The process is documented at https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Moveapeertoanewsite. It describes a physical move to a different location, but the concept is the same.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...