From Step No.3 Install new Indexer nodes Please correct me if I'm wrong, The overall step that you mention are 1. Add all new Indexers to the same cluster. 2. Increase the replicate data between Indexer. #CM
[clustering]
max_peer_build_load = 20 (default 2)
max_peer_rep_load = 50 (default 5) 3. Rebalance the data to reduce the bucket size on the old indexer and make copies of the data to the new indexer. 4. Put one of the old indexers in manual detention to prevent data replication to the old indexer !!Do this one by one
splunk edit cluster-config -manual_detention on 5. Use the splunk offline --enforce-counts command to stop the indexer and force the Cluster Master to copy the remaining primary buckets to the new indexer. !!Do this one by one
splunk offline --enforce-counts 6. Remove the old indexer from cluster. !!Do this one by one
splunk remove cluster-peers -peers <peer_id>
... View more