Deployment Architecture

How to migrate from an indexer clustering to a standalone environment?

sidekix24
Path Finder

Weird question, but does anyone have a graceful procedure to go from clustered environment to stand alone?

Current setup:

1 master node
2 indexers clustered
1 stand alone search head

Company wants to go with:
2 search heads and 1 indexers to prepare for a multisite cluster down the road. Master Node will just sit idle for now. I know there's an "offline" command that we can run to take out the indexer from the cluster and then just need to re-point the search head to the correct peer, but I wanted to see if there's a graceful way to do this or if I'm going to run into any issues using the steps above.

thanks

0 Karma

Masa
Splunk Employee
Splunk Employee

If you're going to have multi-site Clustering, why do you need to make it non-Indexer Clustering env?

Probably the following steps would work. I strongly recommend to test it in a test env before trying it if possible.

  1. Change CM's RF and SF to 1
  2. Restart CM
  3. Remove excess buckets to make sure only one copy per bucket
  4. Stop CPs(Indexers) and remove Clustering settings
  5. Move apps from etc/slave-apps to etc/apps
  6. Start the Indexers
  7. Stop SH and remove clustering configurations
  8. Start SH and add those indexers as Search Peers from Splunkweb
  9. Stop CM
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...