Getting Data In

Lost data after indexers had to rebuild in an indexer cluster. Is there a way to recover this?

Communicator

I had to rebuild my two slave indexers, but the master is still intact. However, I lost all data prior to the rebuild. Does the master not maintain a copy of the data? If not, had I rebuilt one, and waited for data replication before rebuilding the second, would I have maintained the data?

Also, how can I determine how long replication from one indexer to another is taking?

0 Karma
1 Solution

Motivator

Sorry Tim....the master only manages the slaves, so I really hope you were taking backups. If you had only rebuilt one of them AND if you had replicated data on the other one then yes it would have replicated once you re-added the rebuilt slave to the cluster.

The replication time is trickier - it depends on index sizes, server horsepower, bandwidth and the phases of the moon. Splunk doesn't really provide anything for that which is very good in my opinion, but you can watch the progress of your fixup jobs on either the master or on a DMC if you have one setup.

If you don't have any backups....well, you're screwed. Sorry, dude.

View solution in original post

0 Karma

Motivator

Sorry Tim....the master only manages the slaves, so I really hope you were taking backups. If you had only rebuilt one of them AND if you had replicated data on the other one then yes it would have replicated once you re-added the rebuilt slave to the cluster.

The replication time is trickier - it depends on index sizes, server horsepower, bandwidth and the phases of the moon. Splunk doesn't really provide anything for that which is very good in my opinion, but you can watch the progress of your fixup jobs on either the master or on a DMC if you have one setup.

If you don't have any backups....well, you're screwed. Sorry, dude.

View solution in original post

0 Karma

Communicator

Fortunately this is not a production environment. So the loss of data is actually a good lesson learned for production. Thanks!

0 Karma

Motivator

Phew - I'm glad it's not prod! I was worried for ya!

0 Karma