Can we add new indexer through UI and what happens to the data when indexers are removed

[vrmandadi]

1.What are the steps to add new indexer through the WEB UI? .

1. what are steps to be taken to remove indexers from cluster?

2. What happens to the data in the indexers which are removed? and if data is lost how to recover?

Thanks in advance

[nickhills · Accepted solution]

1.) No, it can not be done from the web UI
2.) https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Takeapeeroffline
3.) During decomission, the retiring indexer will transfer its primacy of buckets to another peer(s), and the cluster will replicate buckets to make sure there are sufficient copies (according to SF/RF) remaining in the cluster - Thus no data is lost!

[vrmandadi]

Hello @nickhillscpl .Thank you for your reply .I did not understand the 3rd point .We have 5 indexers now and we are with SF,RF as 2 .Now we are removing three indexers and adding another one .Should we change the SF and RF .Regarding data loss .Can you please elaborate , when we remove the indexer where does the data in the indexer goes to , doe s it send it to the other indexers?

[nickhills]

If you can, add your new indexer first. Then decomission the 3 old indexers 1 at a time.

Yes, when you decom an old indexer it will reassign any primary copies it has to another member.
The cluster will then replicate data between the remaining indexers to restore your target SF/RF.

Since you have SF & RF of 2, there are always two copies of every bucket in the cluster. This means that your old server will not have the sole copy of any data.
When the decom is finished, the data will not get removed from your old indexer - it just becomes unimportant (to the cluster)

I just updated the wording of 3 - does that make sense?

[vrmandadi]

Thank you so much for the explanation.Step 2 you have mentioned will make sure that it will reassign the copies to another member right