Hi @himaniarora20 ,
as @burwell hinted, you can find the documentation that can guide you in the migration from a stand-alone indexer to a an Indexer Cluster.
In my opinion this isn't a question for the Community but a job for a Splunk Architect, because there are some mandatory activities to perform before the manual configuration (that can be mainly done via GUI):
- analyze the volume data to identify the correct number of Indexers (around 200 GB/day for each Indexer if you don't have Enterprise Security or ITSI);
- if you have more than 2 Indexers, define the Search Factor and The Replication Factor;
- only at this point, you can define the requirements in terms of storage for each Indexer:
- at least, design your distributed architecture.
To this point, you can configure the Indexer Cluster (Search Peers and Master Node) by GUI and then the Search Heads by GUI and the other components (Deployment Server and eventually Monitoring Console) following the indication by @burwell.
At the end, you must manually configure the indexes.conf files to distribute to Search peers by Master Node on the configuration files.
As I said the most important job is the preliminary phase that requires the knowledge of a Splunk Architect for a correct design.
Ciao.
Giuseppe
