Hello Everyone
There is one index cluster, one search header, one management node, and three peers. The configuration is RF=3 and SF=3.
There is a non-clustered indexer, and many universal forwarder have sent data to this non-clustered indexer.
I want this non-clustered indexer to join this cluster and have this cluster take over the incoming data from this indexer. If this indexer fails, other peers in the cluster can store its data.
What should I do?
Hi @MikeWilliams ..
Please check the process here..
https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Addclusterpeer
Let us know if any issues, queries.. thanks.