Deployment Architecture

Add non-clustered indexer and standalone search head to existing cluster

splunkreal
Motivator

Hello,
we had standalone search head and indexer in a pre-production environment then I created new clustered environment with 2 sh and 2 idx.

I want to add those old non-clustered search head and indexer, could you let me know the right commands/procedures to add them to the existing cluster? Do I need to remove all Splunk instances and reinstall from scratch?

I understand old non-clustered data may be removed but this is not a problem as mostly frozen.

Thanks for your help.

* If this helps, please upvote or accept solution if it solved *
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Only brand-new Splunk instances should be added to a SH cluster.  Once the cluster is built you can copy custom apps and user artifacts from the old SH (via the SHC Deployer).

Assuming you have enough disk space, yes you should be able to increase the RF/SF settings.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There's a manual for that.  See https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Migratenon-clusteredindexerstoaclustered...

---
If this reply helps you, Karma would be appreciated.

splunkreal
Motivator

Thanks Rich, what about the search head? I read it should be clean?

I think reinstalling totally Splunk on both of them is recommended?

May I be able to safely switch RF/SF from 2 to 3 afterwards?

Thanks for your help.

 

* If this helps, please upvote or accept solution if it solved *
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Only brand-new Splunk instances should be added to a SH cluster.  Once the cluster is built you can copy custom apps and user artifacts from the old SH (via the SHC Deployer).

Assuming you have enough disk space, yes you should be able to increase the RF/SF settings.

---
If this reply helps you, Karma would be appreciated.

splunkreal
Motivator

Thanks Rich, adding new SH with "splunk init shcluster-config -replication_factor 2" ? or I can directly use -replication_factor 3 then update other SH with same value?

By the way I think this is confusing with [clustering] replication_factor, it should be have named search_artifacts_factor or similar 🤔

 

Doc server.conf: [shclustering]

replication_factor = <positive integer>
* Determines how many copies of search artifacts are created in the cluster.
* This must be set to the same value on all members.
* Default: 3

 

Regarding search_factor & replication_factor for manager node I may keep SF=2 and RF=2 as pre-production environment.

Thanks 🤗

* If this helps, please upvote or accept solution if it solved *
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I would add the new SH using the same RF as the rest of the cluster.  You can increase the RF later.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...