I am cutting over non-clustered indexers (v7.3.3) to a new smart store (s2) index cluster (v8.0.6).
Currently I have all new incoming data going to the new s2 idx cluster, and the old indexers are not taking on any new data. All coldToFrozen time settings on the old indexers are commented out/ stopped. In other words, the warm data is not growing or rolling off to frozen.
Our challenge is getting the non-frozen data and the frozen data into the new s2 indexer cluster so we can decom' the legacy non-clustered indexers.
Our plan is to start with the non-frozen data first, then thaw the frozen data and move that into the s2 idx cluster.
We have been reading splunk documentation but we are still a little confused by the process.
Because of the high processing cost of converting standalone buckets to replicated buckets (due to the need to make multiple searchable and non-searchable copies of those buckets to fulfill the cluster's replication and search factors), it is generally a bad idea to attempt to do so, particularly in the case of indexers with large numbers of standalone buckets. There is no supported procedure for this conversion. If, however, you have a strong need for such a conversion, contact Splunk Professional Services to discuss the trade-offs and requirements for this operation.
But I find that statement from Splunk unacceptable... we pay for support, so they should share the process.
If anyone else knows how to do this, please reply.
If I understood right your requirement then you must contact to Professional Services and ask their helps, if you really want migrate unclustered data from old indexer node to the new clustered indexers. If you found any other reliable way to do it, I'm interested too 😉
Another option is just copy that data to some S3 buckets and waiting that it will aged out. r. Ismo