Deployment Architecture

Is there a document for best practices in decommissioning an indexer (IDX) cluster?

rbal_splunk
Splunk Employee
Splunk Employee

Is there a document for best practices in decommissioning an IDX cluster?

We are going back to stand alone indexers. I found this one, but it doesn’t seem to fit their request. http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Decommissionasite

0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

The issue would be duplicate data that would be returned when just converting back to standalone indexers. you can try something like:

1) on the cluster, set replication_factor=1, search_factor=1. restart CM
2) roll the existing hot buckets on all the indexers, so all hot buckets have only a single copy
3) run remove_excess_buckets to "dedup" the cluster
4) convert to standalone indexers (edited)

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

The issue would be duplicate data that would be returned when just converting back to standalone indexers. you can try something like:

1) on the cluster, set replication_factor=1, search_factor=1. restart CM
2) roll the existing hot buckets on all the indexers, so all hot buckets have only a single copy
3) run remove_excess_buckets to "dedup" the cluster
4) convert to standalone indexers (edited)

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...