Deployment Architecture

How to make a cluster take over the data of an indexer that just joined the cluster

MikeWilliams
New Member

Hello Everyone

There is one index cluster, one search header, one management node, and three peers. The configuration is RF=3 and SF=3. 

There is a non-clustered indexer, and many universal forwarder have sent data to this non-clustered indexer.

I want this non-clustered indexer to join this cluster and have this cluster take over the incoming data from this indexer. If this indexer fails, other peers in the cluster can store its data.

What should I do?

Labels (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @MikeWilliams .. 

Please check the process here.. 
https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Addclusterpeer

Let us know if any issues, queries.. thanks. 

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...