Getting Data In

Migrating my current indexer cluster to a multisite cluster, if I add two new indexers, will old data be replicated?

lukasz92
Communicator

Hi,

I have cluster with two indexers (A,B), and a lot of indexed data.
I want to add two new indexers (C,D), and decided to do a multisite clustering: site1- A,B ; site2 - C,D.

I want to set replication and search factors to 3: origin 2, all 1 and wonder if old indexed data (on A and B) would be replicated to site2?

0 Karma

dxu_splunk
Splunk Employee
Splunk Employee

No they won't be. They'll behave like single-site buckets - and only replicate within the site that they were created (A,B), and follow the old single-site replication_factor search_factor policies. (Your new buckets will follow the new multi-site configuration). See http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Migratetomultisite#How_the_cluster_migrate...

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...