Monitoring Splunk

Adding peers to indexer cluster when you ran out of disk space

arsalanj
Path Finder

Let's say I have a cluster with replication factor=2.
If I realize that after a while the indexer is running out of disk space, is it possible to add new indexer peers and instruct Splunk to send the new data to the newly added nodes and those nodes only replicate the new data to each other?

So, indexer 1 and indexer 2 have the same data. when they run out of disk space I add indexer 3 and indexer 4.
I will stop sending the logs to indexer 1 and indexer 2.
I will only send the logs to indexer 3 and indexer 4.
Indexer 3 and Indexer 4 have the same data but they don't have the data resides on indexer 1 and indexer 2.
Is this something that can be accomplished with Splunk?

Regards,
Arsalan

Labels (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, but that's not the right way to do it. Just add the new indexer and rebalance:
https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Rebalancethecluster

View solution in original post

0 Karma

woodcock
Esteemed Legend

Yes, but that's not the right way to do it. Just add the new indexer and rebalance:
https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Rebalancethecluster

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...