Getting Data In

Lost data after indexers had to rebuild in an indexer cluster. Is there a way to recover this?

timmy13
Communicator

I had to rebuild my two slave indexers, but the master is still intact. However, I lost all data prior to the rebuild. Does the master not maintain a copy of the data? If not, had I rebuilt one, and waited for data replication before rebuilding the second, would I have maintained the data?

Also, how can I determine how long replication from one indexer to another is taking?

0 Karma
1 Solution

lycollicott
Motivator

Sorry Tim....the master only manages the slaves, so I really hope you were taking backups. If you had only rebuilt one of them AND if you had replicated data on the other one then yes it would have replicated once you re-added the rebuilt slave to the cluster.

The replication time is trickier - it depends on index sizes, server horsepower, bandwidth and the phases of the moon. Splunk doesn't really provide anything for that which is very good in my opinion, but you can watch the progress of your fixup jobs on either the master or on a DMC if you have one setup.

If you don't have any backups....well, you're screwed. Sorry, dude.

View solution in original post

0 Karma

lycollicott
Motivator

Sorry Tim....the master only manages the slaves, so I really hope you were taking backups. If you had only rebuilt one of them AND if you had replicated data on the other one then yes it would have replicated once you re-added the rebuilt slave to the cluster.

The replication time is trickier - it depends on index sizes, server horsepower, bandwidth and the phases of the moon. Splunk doesn't really provide anything for that which is very good in my opinion, but you can watch the progress of your fixup jobs on either the master or on a DMC if you have one setup.

If you don't have any backups....well, you're screwed. Sorry, dude.

0 Karma

timmy13
Communicator

Fortunately this is not a production environment. So the loss of data is actually a good lesson learned for production. Thanks!

0 Karma

lycollicott
Motivator

Phew - I'm glad it's not prod! I was worried for ya!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...