Deployment Architecture

How to copy already indexed data to the new indexer in multisite indexer clustered environment?

sudeshgaur
New Member

I have two sites in my multisite clustered environment. On site 1, I have 4 indexers, and on site -2 I have 1 indexer. On site 2, I am planning to decommission the current peer node (indexer) and add two new peer nodes (indexers).
How can I copy/replicate already indexed data to new peer nodes (indexers) without any downtime, and what is the best way to copy the old data?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Since you are decommissioning the old indexer, the right search term to find relevant articles and questions is "move index" or "migrate index". The down time is not major, since you are not actually re-indexing the data, just copying the indexes and the data to the equivalent location, changing the environmental variables, and then starting it in the new place.

It might simplify and speed the migration to move it to the new cluster with only one indexer running there, then after validating, you can bring up the second and engage any replication on the cluster. (But then, I'm a belt-and-suspenders-and-duct-tape kind of guy.)

Here's the documentation...

https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Moveanindex

And here's some other relevant results...

https://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk...
https://answers.splunk.com/answers/32176/is-it-possible-to-migrate-indexed-buckets-to-a-different-in...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...