Adding existing index to cluster master

[Atchyuth_P]

Hi team,

I have two indexers in a clustered environment and one of my colleague created a index in both the indexers (/opt/splunk/etc/apps/search/indexes.conf) not on the cluster master. This is very old index and have more than 50GB of data

If I add the same config in master (/opt/splunk/etc/master-apps/_cluster/local/indexes.conf) will it hamper anything. Would I lose any data.

[gcusello]

Hi @Atchyuth_P ,

at first you cannot replicate old data in a cluster.

so if for the clustered indexes you use the same names of the old not clustered indexes, you lose your old data,

so the best approach is to use different names and create in you searches two eventtypes that use both the indexes (clustered and not clustered), waiting for the natural end of the old indexes, that will not receive new data and will be empty for the exceeding of the retention time.

Otherwise, you could (but it's a very long job) export all your data from the old indexes (divided by sourcetype and host) and then import them in the new clustered indexes, but, as I said, it's a long job!

Ciao.

Giuseppe