Hi as @richgalloway said the easiest way to do it, is contacting to Splunk PS. If you want to try it by yourself then here is instructions how to convert single peer to indexer cluster https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Migratenon-clusteredindexerstoaclusteredenvironment. There is also instruction how to go multisite cluster. You can do multisite cluster also with one site if you don't need it now but maybe later. Before you start to migrate current one, you should consider is it better to just create a new indexer cluster from scratch and then add both old peer and new cluster as search peers to your SH? Especially if your current search peer has short data retention time this could be a reasonable option. r. Ismo  ... View more