Hi As @richgalloway said, it quite easy to switch IDX to HF, but can you search that old data or not is interesting question. I haven't try it as usually it's much easier and cheaper (you probably have lot of disk space used in indexer which are not needed on HF and probably more resources than it's needed after switch over?) to add a new HF than convert IDX to HF. Basically just install a new instance then switch those IP's to then new one and add that old as a search peer to the new SH(s). Of course you can and actually should add HF to search peer to your MC to see what happening there, but add HF as "normal" search peer to SH maybe not the best option? If you still want to convert your indexer as a HF then just add a outputs.conf which sends all events to the new indexer(s) as described here: https://docs.splunk.com/Documentation/Splunk/9.0.1/Indexer/Forwardmanagerdata r. Ismo
... View more