Yes， We have a lot of things manually created by users on the cluster, and we need to migrate some specific user content and ensure that the things created by users can be modified and deleted normally. We need a long time to sort out the content that needs to be migrated, which is also the reason why I didn't want to do it at the beginning. But now this is the only way. 1. We will first sort out the default push configurations and user created configurations for the clusters that need to be migrated. 2. Copy the content that needs to be migrated to the deployer of the new cluster, and place the user created content in the local directory 3. Perform a full mode push once ... View more

@PickleRick @isoutamo @livehybrid @kiran_panchavat  The test found that when some nodes are isolated, the isolated nodes will not elect a new caption, because it requires more than half of the total number of nodes. And the caption cannot be manually specified. The following is the returned information. This node is not the captain of the search head cluster, and we could not determine the current captain. The cluster is either in the process of electing a new captain, or this member hasn't joined the pool https://docs.splunk.com/Documentation/Splunk/9.4.2/DistSearch/SHCarchitecture#Captain_election ... View more

Thanks for your answer, I will try this in a test environment ... View more

@kiran_panchavat  thanks for your answer, we want to split a big shcluster. not a mutisite cluster. ... View more