Splunk Enterprise

Add data to 1 Indexer after Indexer Cluster is implemented

neeravmathur
Path Finder

Hi Guys,

We recently had 1 Indexer in Melbourne ( server A). It had a lot of data and later due to a disaster recovery requirement we had to setup a new  indexer in Sydney(Server B) and then enabled Indexer clustering between the two. 

So far so good. Problem arises when we found out that there is another Indexer in Sydney (server C) and we need to migrate data off of it to our Sydney instance (B) as C is an old WIN server and is being retired. 

Question: How can I proceed with this? Simply move the indexes and buckets from C over to our Sydney Instance(B)?

Since clustering is on, what needs to be done so that this data does not get replicated over to Indexer in Melbourne (A) and only stays in (B)??

Thanks in Advance,

Neerav

Labels (1)
0 Karma

somesoni2
Revered Legend

You can simply copy the data buckets with standalone Index bucket names (db_latesttime_earliesttime_idnum) as is to your Indexer B and restart. Before you start migration, make sure Index C has data ingestion turned off and restart that indexer to make sure all host buckets are rolled to warm state. Leaving the buckets with standalone index names will ensure that they'll not get replicated but can still be searched upon.

neeravmathur
Path Finder

@somesoni2 ,

Thanks, another question. We have multiple standalone Indexers as search peer to our search head cluster, will it be an issue to add indexer clustering to this search head cluster?

In other words can 1 search head cluster have standalone Indexers as search peers and Indexer clustering both working at the same time? 

0 Karma

somesoni2
Revered Legend

Yes, a search head (or SHC) can have standalone and clustered indexers both as a search peer at the same time.

0 Karma

neeravmathur
Path Finder

@somesoni2  Awesome..Thanks for your help !!

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...