In a cluster with a replication factor of 3, if one indexer is replaced, will a copy of the data from the 2 working indexers replicate to the new indexer?

[sympatiko]

Hi splunkers,

Good day! I have a clustered setup of RF=3 and SF=3. I'm just curious, what if one of my indexers needs to be replaced because of a certain outage (server outage). Does the copy of the data from the two working indexers replicate to the new indexer replacement?

Thanks

[mahamed_splunk]

The cluster master goes by the replication policies you set. In your case it's RF/SF = 3. At the time of adding new indexer, if all the policies are already met (ie, the system has 3 copies of all data), then the old data will not be replicated on the new indexer.

[sympatiko]

Hi mohamed,,

Thanks for the info! What I mean is what if I will replace 1 of my indexer with a new and fresh splunk indexer and put it in the same cluster. Does the old data on the two indexers be replicated to the replacement indexer? If not, is there any way to do it?

Thanks for the time.

[Venkat_16 · Accepted solution]

once the new indexer comes into the cluster it automatically replicates to new cluster. we also need to copy n paste indexes & server.conf.
once you deploy the same app (which is pushed to other indexers) to the new indexer, with same cluster master.. it automatically does it

[martin_mueller]

Yeah, this applies to old data as well as new data.

The master's goal is to make sure every bucket has three searchable copies according to your configuration, and once it has three indexers it will tell them to achieve that goal.

[sympatiko]

Hi martin,

Thank u so much! Appreciated!!

[sympatiko]

Hi Venkat,

Thanks for your info. Is the whole data being replicated? I'm talking about the old data. Example, my two indexer is already 2 months running then I add a new indexer, does it replicate the whole 2 months old data as well?

Thanks you so much!!