Getting Data In

Migrating my current indexer cluster to a multisite cluster, if I add two new indexers, will old data be replicated?



I have cluster with two indexers (A,B), and a lot of indexed data.
I want to add two new indexers (C,D), and decided to do a multisite clustering: site1- A,B ; site2 - C,D.

I want to set replication and search factors to 3: origin 2, all 1 and wonder if old indexed data (on A and B) would be replicated to site2?

0 Karma

Splunk Employee
Splunk Employee

No they won't be. They'll behave like single-site buckets - and only replicate within the site that they were created (A,B), and follow the old single-site replication_factor search_factor policies. (Your new buckets will follow the new multi-site configuration). See

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...