I have cluster with two indexers (A,B), and a lot of indexed data.
I want to add two new indexers (C,D), and decided to do a multisite clustering: site1- A,B ; site2 - C,D.
I want to set replication and search factors to 3: origin 2, all 1 and wonder if old indexed data (on A and B) would be replicated to site2?
No they won't be. They'll behave like single-site buckets - and only replicate within the site that they were created (A,B), and follow the old single-site replication_factor search_factor policies. (Your new buckets will follow the new multi-site configuration). See http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Migratetomultisite#How_the_cluster_migrate...