Deployment Architecture

Add non-clustered indexer and standalone search head to existing cluster

realsplunk
Motivator

Hello,
we had standalone search head and indexer in a pre-production environment then I created new clustered environment with 2 sh and 2 idx.

I want to add those old non-clustered search head and indexer, could you let me know the right commands/procedures to add them to the existing cluster? Do I need to remove all Splunk instances and reinstall from scratch?

I understand old non-clustered data may be removed but this is not a problem as mostly frozen.

Thanks for your help.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Only brand-new Splunk instances should be added to a SH cluster.  Once the cluster is built you can copy custom apps and user artifacts from the old SH (via the SHC Deployer).

Assuming you have enough disk space, yes you should be able to increase the RF/SF settings.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There's a manual for that.  See https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Migratenon-clusteredindexerstoaclustered...

---
If this reply helps you, Karma would be appreciated.

realsplunk
Motivator

Thanks Rich, what about the search head? I read it should be clean?

I think reinstalling totally Splunk on both of them is recommended?

May I be able to safely switch RF/SF from 2 to 3 afterwards?

Thanks for your help.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Only brand-new Splunk instances should be added to a SH cluster.  Once the cluster is built you can copy custom apps and user artifacts from the old SH (via the SHC Deployer).

Assuming you have enough disk space, yes you should be able to increase the RF/SF settings.

---
If this reply helps you, Karma would be appreciated.

realsplunk
Motivator

Thanks Rich, adding new SH with "splunk init shcluster-config -replication_factor 2" ? or I can directly use -replication_factor 3 then update other SH with same value?

By the way I think this is confusing with [clustering] replication_factor, it should be have named search_artifacts_factor or similar 🤔

 

Doc server.conf: [shclustering]

replication_factor = <positive integer>
* Determines how many copies of search artifacts are created in the cluster.
* This must be set to the same value on all members.
* Default: 3

 

Regarding search_factor & replication_factor for manager node I may keep SF=2 and RF=2 as pre-production environment.

Thanks 🤗

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I would add the new SH using the same RF as the rest of the cluster.  You can increase the RF later.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...