Is there a document for best practices in decommissioning an IDX cluster?
We are going back to stand alone indexers. I found this one, but it doesn’t seem to fit their request. http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Decommissionasite
The issue would be duplicate data that would be returned when just converting back to standalone indexers. you can try something like:
1) on the cluster, set replication_factor=1, search_factor=1. restart CM
2) roll the existing hot buckets on all the indexers, so all hot buckets have only a single copy
3) run remove_excess_buckets to "dedup" the cluster
4) convert to standalone indexers (edited)
The issue would be duplicate data that would be returned when just converting back to standalone indexers. you can try something like:
1) on the cluster, set replication_factor=1, search_factor=1. restart CM
2) roll the existing hot buckets on all the indexers, so all hot buckets have only a single copy
3) run remove_excess_buckets to "dedup" the cluster
4) convert to standalone indexers (edited)