Getting Data In

How is it possible to move indexers to different site in same cluster

bfarr
Loves-to-Learn

I had 6 indexers in a cluster in 2 sites A and B. One of the admins(through scripting) configured 6 more indexers but accidentally added them all to site A instead of distributing them evenly(this was 2 weeks ago so there is lots of data on them already).

To distribute them evenly - 6 in site A and 6 in site B - is this as simple as:

  • enable maintenance mode
  • change the site in server.conf to the 3 I want moved to site B
  • disable maintenance mode
  • rebalance?

It seems too easy so I am hesitant.

We run the sites as such:
multisite = true
replication_factor = 2
site_replication_factor = origin:1,siteA:1,siteB:1,total:2
site_search_factor = origin:1,siteA:1,siteB:1,total:2

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's a little more involved than that. The process is documented at https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Moveapeertoanewsite. It describes a physical move to a different location, but the concept is the same.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...