Deployment Architecture

How to make a cluster take over the data of an indexer that just joined the cluster

MikeWilliams
New Member

Hello Everyone

There is one index cluster, one search header, one management node, and three peers. The configuration is RF=3 and SF=3. 

There is a non-clustered indexer, and many universal forwarder have sent data to this non-clustered indexer.

I want this non-clustered indexer to join this cluster and have this cluster take over the incoming data from this indexer. If this indexer fails, other peers in the cluster can store its data.

What should I do?

Labels (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @MikeWilliams .. 

Please check the process here.. 
https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Addclusterpeer

Let us know if any issues, queries.. thanks. 

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...