About pcsegal1

pcsegal1 · ‎04-07-2020

A follow up question about the described scenario: After license expiration, when downgrading the cluster members from Enterprise to Free, is there any special procedure that needs to be performed to make sure that the already existing data (everything that was indexed prior to the expiration) is preserved?

pcsegal1 · ‎04-07-2020

Hi, could you please elaborate on "such easy way only for all in one installations"? If I have an indexer cluster with 3 indexers, and one search head, is there any special procedure that needs to be performed to ensure the indexers will preserve the already existing data?

pcsegal1 · ‎04-07-2020

@richgalloway - Thank you. Just to clarify, the reason for the question was that, when downgrading a cluster to Free, I assume all instances would automatically become standalone. Is that correct? So, I imagined this license downgrade would end up in the same complex scenario of going from cluster to standalone. Would any complex procedure be required in this case as well?

pcsegal1 · ‎04-07-2020

@richgalloway - I have a follow-up question. Let's say that the cluster's Enterprise license expires, and all instances are downgraded to Free. Since clustering and distributed search are not supported in Free, does that mean that all data is automatically removed? Or is the data still preserved?

pcsegal1 · ‎03-23-2020

Thank you. I just wanted to clear up a doubt: if the indexer can support direct searching, then, after the procedure you outlined, if I then remove the indexer from the cluster, wouldn't it effectively become a standalone instance?

pcsegal1 · ‎03-20-2020

@richgalloway Generally speaking, what I need is to reduce the number of instances as much as possible (ideally to 1) in order to save costs while still keeping the legacy data accessible. If going back to a standalone is very tricky or impossible, I think downgrading to a single-node cluster could be a good compromise. Could you please share the procedure? Thank you!

pcsegal1 · ‎03-20-2020

Hi, I have a legacy Splunk Enterprise cluster that consists of: 1 cluster master 3 indexers, forming an indexer cluster 1 search head 1 license master This cluster will stop receiving data. I need to downgrade it from cluster to standalone, and I need to preserve its existing data in such a way that it remains searchable. That is, I need to downgrade this cluster to only one instance: a single standalone instance that contains the same data as the indexer cluster. Is this possible? What steps should I perform?

pcsegal1 · ‎01-02-2020

Thank you. Just to make sure I understand: If I make sure that (1) data stops coming into the indexers before the license expires, and (2) the license is downgraded to Free in the license master, do the indexers automatically become standalone and individually searchable?

pcsegal1 · ‎12-28-2019

Hi, I have a Splunk Enterprise cluster that consists of: 1 cluster master 3 indexers 1 search head 1 license master My doubt is: when the Enterprise license expires and you don't include a new license, what happens to the data already residing in the indexers? Does it remain accessible? Is there any specific procedure that I would need to perform to make sure the data would remain accessible in that situation? As I understand it, Splunk lets you to downgrade to a Free license, and then you lose all the Enterprise features, including distributed search. Given that Free license doesn't allow distributed search, does this mean that the 3 indexers will automatically become standalone instances, and I'd still be able to search their data individually?

pcsegal1 · ‎12-23-2019

I applied your first approach (put in %SPLUNK_HOME/etc/master-apps/_cluster/local an indexes.conf file for the _audit index) and it worked as expected. Thank you and Merry Christmas.

pcsegal1 · ‎12-22-2019

Hi, I have a Splunk cluster that consists of: - 1 cluster master - 3 indexers - 1 search head The indexes at the search head are configured to be forwarded to the indexers. I would like to set a retention period shorter than the 6-year default to the _audit index in this Splunk cluster. Normally, to deploy indexes to the indexers, the procedure I use is to create an app with an indexes.conf inside the cluster master's master-apps directory, then push the configuration. However, I'm unsure if this procedure would work for _audit. How should I go about changing the retention period of the _audit index in all the indexers?

Posts	11
Solutions	0
Karma Given	5
Karma Received	1
Member Since	‎12-22-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Migrate from indexer cluster to standalone instanc...

Indexer cluster - does data remain accessible afte...

_audit index data retention in Splunk cluster

Re: Indexer cluster - does data remain accessible ...

Re: Is it posible to downgrade Splunk enterprise t...

Re: Migrate from indexer cluster to standalone ins...

Re: Migrate from indexer cluster to standalone ins...

Re: Migrate from indexer cluster to standalone ins...

Re: Migrate from indexer cluster to standalone ins...

Migrate from indexer cluster to standalone instanc...

Re: Indexer cluster - does data remain accessible ...

Indexer cluster - does data remain accessible afte...

Re: _audit index data retention in Splunk cluster

_audit index data retention in Splunk cluster

Are you a member of the Splunk Community?