Getting Data In

How do I cluster a new index server with my production index server?

molinarf
Communicator

I have one indexer and would like to add another indexer for redundancy. Is it possible to cluster the two together and have the data replicated. Also, once the cluster is functioning what would happen if I take down the master? I would like to be able to answer that question because we are currently working towards a fail over plan.

I currently have one indexer which is doubles as a search head and a second indexer at another site that forwards data to the first indexer. I want to add a new indexer that would replicate with the first indexer.

Eventually, I would like to take down the first indexer and have the new indexer be the primary indexer then I will build a new one that is virtual.

I hope that is clear enough.

Thank you,
Robert

Tags (2)
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

The short answer to your questions are as follows:

You can have a cluster configuration, and it will replicate the buckets. However, it will not replicate historical data, only the data from the time you enable clustering and bring up the required peers to meet the search and replication factor. There is no concept of a primary indexer, data is balanced across the cluster. The only thing that is added is the Cluster Master role.

If you are wanting to migrate to a new indexer, you're better not to use clustering as a way to build and replicate data. Things can get tricky if you try to migrate from Clustered back to standalone.

Read here : http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters

View solution in original post

0 Karma

molinarf
Communicator

Based on what you said and everything I read, it would be best that I don't cluster to migrate. If I migrate to a new server can I copy the buckets across to it to replicate? After that, I can then stand up the virtual server that I wanted to so that I can cluster off that. I. I understand that once I cluster that I shouldn't return back to a standalone. I don't think I will because the goal is to have resiliency.

Robert

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

The short answer to your questions are as follows:

You can have a cluster configuration, and it will replicate the buckets. However, it will not replicate historical data, only the data from the time you enable clustering and bring up the required peers to meet the search and replication factor. There is no concept of a primary indexer, data is balanced across the cluster. The only thing that is added is the Cluster Master role.

If you are wanting to migrate to a new indexer, you're better not to use clustering as a way to build and replicate data. Things can get tricky if you try to migrate from Clustered back to standalone.

Read here : http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...