Deployment Architecture

How to make a cluster take over the data of an indexer that just joined the cluster

MikeWilliams
New Member

Hello Everyone

There is one index cluster, one search header, one management node, and three peers. The configuration is RF=3 and SF=3. 

There is a non-clustered indexer, and many universal forwarder have sent data to this non-clustered indexer.

I want this non-clustered indexer to join this cluster and have this cluster take over the incoming data from this indexer. If this indexer fails, other peers in the cluster can store its data.

What should I do?

Labels (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @MikeWilliams .. 

Please check the process here.. 
https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Addclusterpeer

Let us know if any issues, queries.. thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...