If we remove a corrupted peer in an indexer cluster, will hot and warm buckets from existing indexers populate to the new replacement peer?

[sudeshgaur]

We have 4 indexers, and if 1 peer is corrupted, we have 0 hot 0 cold 0 frozen now. If we remove the corrupted peer from cluster and add new peer node, will it populate the hot and warm buckets from 3 other indexers in the cluster to the 4th new peer?

[Steve_G_]

You can also rebalance the cluster to distribute buckets to the new node. Adding a new node is a key use case for data rebalancing. See http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Rebalancethecluster

[lguinn2]

If you add a new peer node while the cluster is still in recovery mode, then yes - some of the warm and cold buckets will be copied to the new peer. The new peer will also receive replicas as new hot buckets are indexed.

There is no guarantee that things will be "perfectly balanced" at the end of recovery, but it will probably be good enough.

I think it is better to add your new peer now so it can participate in the recovery.