Is it really required to stop indexer services while adding another indexer?

[ramesh12345]

I have one machine which is acting as an indexer as well as a search head. So, i want to add another indexer. So what is the procedure to do this and also what configurations files do I need to copy from the previous indexer?

Please help me.

[nilbak1]

Hi @ramesh12345
I assumed this as non-clustered indexer. What you have to do here is:

• Install Splunk Enterprise on the new server,
• add to your search head a new search peer [Settings -- Distributed Search -- Search peer] and you are done
• Modify outputs.conf of your forwarders and add this new indexer as well.

Hope, it clears your doubts.

[ramesh12345]

Thank you very much for your reply @nilbak1. I have some other doubts is it really mandatory to copy indexes.conf to new indexer machine?

[Steve_G_]

You will probably want to copy the indexes.conf file over, to ensure that both indexers use the same settings. For example, assuming that the forwarders will be load balancing across both indexers, you'll need the same set of custom indexes on both indexers.

[ramesh12345]

Thank you Steve for your response.