Any details on how to attempt to cluster legacy data even though it's not recommended?

[bandit]

Any details on how to attempt to cluster legacy data even though it's not recommended?

http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Migratenon-clusteredindexerstoaclusteredenvi...

Is there any way to migrate my legacy data?
Because of the high processing cost of converting standalone buckets to replicated buckets (due to the need to make multiple searchable and non-searchable copies of those buckets to fulfill the cluster's replication and search factors), it is generally a bad idea to attempt to do so, particularly in the case of indexers with large numbers of standalone buckets. There is no supported procedure for this conversion. If, however, you have a strong need for such a conversion, contact Splunk Professional Services to discuss the trade-offs and requirements for this operation.

Thanks,

Rob

[gkanapathy]

Basically, you have to rename legacy buckets to match the new naming format, which simply means appending the GUID of the indexer to the bucket name. However, there are quite a lot of considerations that you have to make sure are met before you "just do this". The simplest are that you have to make sure you have the space, and that you can take the CPU load that will be generated. You also need to make sure that the cluster master is cleared of all bucket information, and it's important that you test with a small number of buckets before doing it to all of them. As noted, the procedure requires a lot of care.

[bandit]

Thanks! Nice to know just in case... 🙂

[dxu_splunk]

http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/HowSplunkstoresindexes