Hi, To create a new Indexer Cluster, you need a additional Splunk machine to use as Cluster Master. You can use this documentation to configure a New Cluster Master. https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/ConfiguremanagerwithCLI Notice that you can use only a max of 2 in Replication and Search Factor because you have only two Indexers. Add your indexers to Cluster following this documentation: https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/ConfigurepeerswithCLI The last step is add your Search Head Cluster nodes to Indexer Cluster using this documentation: https://docs.splunk.com/Documentation/Splunk/8.1.1/DistSearch/SHCandindexercluster *Consider that in an Indexer Cluster it is recommended to have at least 3 Indexers.       ... View more

Hi Edgar. The Splunk have some features to balance or distribute data indexing over multiples indexers and Datacenters, but Splunk dont have a way to make what you need natively. I think that you can provide this feature using software development, based on type of data ingestion that you need. If you need to create a copy of data in indexer B without a Indexer Cluster, you must to configure it on outputs.conf file in your Heavy Forwarder, [tcpout] defaultGroup = indexerA, indexerB [tcpout:indexerA] server = indexerAIP:9997 [tcpout:indexerB] server = indexerBIP:9997 With this configuration, all data sent to IndexerA, will be sent to IndexerB too.   ... View more