Getting Data In

Lost data after indexers had to rebuild in an indexer cluster. Is there a way to recover this?

timmy13
Communicator

I had to rebuild my two slave indexers, but the master is still intact. However, I lost all data prior to the rebuild. Does the master not maintain a copy of the data? If not, had I rebuilt one, and waited for data replication before rebuilding the second, would I have maintained the data?

Also, how can I determine how long replication from one indexer to another is taking?

0 Karma
1 Solution

lycollicott
Motivator

Sorry Tim....the master only manages the slaves, so I really hope you were taking backups. If you had only rebuilt one of them AND if you had replicated data on the other one then yes it would have replicated once you re-added the rebuilt slave to the cluster.

The replication time is trickier - it depends on index sizes, server horsepower, bandwidth and the phases of the moon. Splunk doesn't really provide anything for that which is very good in my opinion, but you can watch the progress of your fixup jobs on either the master or on a DMC if you have one setup.

If you don't have any backups....well, you're screwed. Sorry, dude.

View solution in original post

0 Karma

lycollicott
Motivator

Sorry Tim....the master only manages the slaves, so I really hope you were taking backups. If you had only rebuilt one of them AND if you had replicated data on the other one then yes it would have replicated once you re-added the rebuilt slave to the cluster.

The replication time is trickier - it depends on index sizes, server horsepower, bandwidth and the phases of the moon. Splunk doesn't really provide anything for that which is very good in my opinion, but you can watch the progress of your fixup jobs on either the master or on a DMC if you have one setup.

If you don't have any backups....well, you're screwed. Sorry, dude.

0 Karma

timmy13
Communicator

Fortunately this is not a production environment. So the loss of data is actually a good lesson learned for production. Thanks!

0 Karma

lycollicott
Motivator

Phew - I'm glad it's not prod! I was worried for ya!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...