Replacing a search peer in an indexer cluster, will warm and cold buckets automatically be copied over when the new indexer joins the cluster?

[hagjos43]

We are replacing (upgrading to new hardware) an indexer that is part of an indexer cluster. In the cluster there are two indexers with replication factor of 2 and search factor of 2. When the new indexer is online and joined to the cluster, will the indexes and all associated historical buckets be auto-magically copied over?

Thanks!
-Joe

[muebel]

Hi hagjos43, With a 2 member cluster set with 2 for search and replication factor, this means that each member will have a full set of searchable buckets. In this way, the cluster can suffer the loss of one member and still have all data searchable. If you want to replace one of the indexers, you'll want to make sure to follow the documentation outlined for this process : http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Takeapeeroffline

In particular, running the offline command with --enforce-counts flagged

splunk offline --enforce-counts

Once the old peer is shutdown, when you add the new member the cluster master will seek to satisfy the search and replication factor requirements, and so the remaining indexer will start streaming copies of all the buckets over to the new member. This will take some time.

Please let me know if this answers your question!