Getting Data In

adding new indexer in existing distributed environment

ramsanga
Explorer

i currently have one indexer and two search heads with one search head with ES. I am planning to add two new indexers in existing setup for load balance and convert existing indexer into heavy forwarder. I am sure i can copy existing indexed DB to one of the newly to be deployed indexer, stop indexing in old indexer and configuring forwarding only . My question is how can i achieve load balance in new setup retaining old indexed data.

Tags (2)
0 Karma

sourabh_varshne
Explorer

Once you add up the two indexers , your new environment will have two indexers, two search heads and one heavy forwarder. Now to enable load balancing follow the below steps.

  1. Enable load balancing at Heavy Forwarders by editing outputs.conf autoLBFrequency = 40 server = \ips of indexers useACK = true
  2. Increase queue size maxQueueSize = 100 MB

This will enable load balancing of data at your indexers. Also enable replication between both of your indexers. Hope this answers your question

ramsanga
Explorer

Thanks sourabh. Just wrt your comment earlier, can replication be enabled with two indexer. According to document, we need one seperate master node and then at least two peer nodes for replication (clustering).please advise..In addition. will replication not not cause low search and indexing performance?

0 Karma

sourabh_varshne
Explorer

Yes you can follow that link. Its perfectly demostrated. You can copy buckets directl and restart your cluster.

0 Karma

ramsanga
Explorer

thanks for your answer on LB side. I wanted to know the best way to copy old indexed data into two new indexer so that i can search old data. I read the article http://answers.splunk.com/answers/6521/expanding-splunk-installation-from-a-single-indexer-to-a-mult...
does this work?

Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...