This is from my experience. The agent continues movement. If the new server is running and connected to the new server. However, apps of the agent side replaces the deployment-apps of the new server by the re-check. If the deployment server side there is no deployment-apps are deployed apps of the agent side is deleted. I think better to remove the setting of serverclass.conf if a trial basis to start the deployment server is good. ... View more

No, Index clustering will only keep the items you place in master-apps on the Cluster Master in sync. For anything in $SPLUNK_HOME/etc/apps or $SPLUNK_HOME/etc/users, you'll need to use a script. ... View more

I would like to be able to do the same sort of thing. Replicate data within a cluster only for some indexes. So some indexes get copies only within sites, and some between sites. I am hoping this may have changed since the post. There is a indexes.conf parameter that allow you to specify the number of replicated copies, but not where. this is repFactor . An example is below. [npac_misc] coldPath = $SPLUNK_DB/npac_misc/colddb homePath = $SPLUNK_DB/npac_misc/db thawedPath = $SPLUNK_DB/npac_misc/thaweddb repFactor = auto ... View more