How to hibernate a whole Splunk Cluster?

[Falko]

I have a Splunk Enterprise Cluster that doesn't get new data ingested anymore. But the existing indexes should remain searchable for a while still. Since search usage is only sporadic I'd like to save on infrastructure cost and hibernate the whole cluster. Only bring it up again when someone needs to search the old data, and hibernate the cluster again.

How would I do this best? My environment consists of search head cluster with 2 members and an indexer cluster with 6 members.

My understanding is, as soons as I start to stop indexers, the cluster would try to rebalance the data in the remaining indexer nodes. That seems suboptimal since I need to stop all the instances eventually and don't want to end up with a single indexer node holding all the data.

Any ideas?

[PickleRick]

https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Usemaintenancemode

That's one thing to read. Probably others might add their three cents on this.

Furthermore, remember to raise your retention periods for the indexes. Otherwise when you power the cluster back on in some time, it might happily roll buckets to frozen because they will already be old enough.

[Falko]

Thanks! This sounds like what I'm looking for. I might give this a try. The indexes in question already have several years of retention period configured. That should be taken care off. It's really just summary indexes that we want to persist for "sentimental reasons" 😉