Knowledge Management

Migrate Summarydb from standalone to SHC

Raghav2384
Motivator

Experts,

Asking this question as my brain's jammed thinking over it.

I have a standalone SH which has a summarydb. I want to move them to 10 member search head cluster. I know these are the things to make sure
1. Compare the bucketids from standalone and SHC and rename if there are any conflicts and move (Offcourse after rolling stuff from hot to warm)
2. Now, i know to migrate indexes to a IDX cluster, i can distribute the buckets among all of the indexers. Is it the same with SHC? I mean, should i copy the entire summarydb to each search head cluster member or distribute buckets to each?
3. Since the standalone has too many buckets, can i just rename the summarydb on SHC members to xsummarydb and then migrate the Standalone summarydb to take that place?

Appreciate your help.

Thanks,
Raghav

1 Solution

lguinn2
Legend

Please stop and reconsider!

In a search head cluster (SHC), you should not have any indexing occurring in the cluster. All indexing should happen on the indexers.
The SHC does not replicate indexes, only knowledge objects and search artifacts (ie, search results). Leaving the summary indexes on any or all of the search heads will not work - you will end up with missing data, either data that is not summarized or data that is missing from search results. It simply doesn't work that way.

Clustered search heads must forward their summary indexes to the indexer tier. In the Distributed Search manual, the process for this is documented here. This is also a best practice for standalone search heads. Internal logs should also be forwarded - and will be if you follow the documentation.

BTW,this is also a best practice for any other Splunk instances, such as License Masters or Deployment Servers, that are not running on the indexer tier.

Finally, you should be able to copy the existing summary index from one search head to a single member of the indexer tier. Searches against that index will be a bit unbalanced for some time period, but will eventually spread across all indexers as new data is summarized. You could also split it up - but I think that should be a separate question: "how do I move a summary index from a search head to multiple indexers?" would be nice...

View solution in original post

lguinn2
Legend

Please stop and reconsider!

In a search head cluster (SHC), you should not have any indexing occurring in the cluster. All indexing should happen on the indexers.
The SHC does not replicate indexes, only knowledge objects and search artifacts (ie, search results). Leaving the summary indexes on any or all of the search heads will not work - you will end up with missing data, either data that is not summarized or data that is missing from search results. It simply doesn't work that way.

Clustered search heads must forward their summary indexes to the indexer tier. In the Distributed Search manual, the process for this is documented here. This is also a best practice for standalone search heads. Internal logs should also be forwarded - and will be if you follow the documentation.

BTW,this is also a best practice for any other Splunk instances, such as License Masters or Deployment Servers, that are not running on the indexer tier.

Finally, you should be able to copy the existing summary index from one search head to a single member of the indexer tier. Searches against that index will be a bit unbalanced for some time period, but will eventually spread across all indexers as new data is summarized. You could also split it up - but I think that should be a separate question: "how do I move a summary index from a search head to multiple indexers?" would be nice...

View solution in original post

Raghav2384
Motivator

Makes perfect sense....i was skeptical with having indexing on Search layer...Thank you Lisa!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!