How do you add replication to a pre-existing index?

[a238574]

I inherited a Splunk cluster that has some custom indexes that were created without setting repFactor=auto. Is it safe for me to update the config and push out the modified config for the impacted indexes?

[jcrabb_splunk]

You can add that setting to existing indexes. New buckets will be index cluster buckets and replicate. The previous buckets will remain as standalone buckets, will be searchable, but will not replicate. As an example:

DB Directory for an index on an index cluster member, index is not configured with repFactor=auto

Oct  4 10:38 db_1538594348_1538594348_0

After adding 'repFactor=auto

Oct  4 10:38 db_1538594348_1538594348_0
Oct  4 10:42 db_1538594348_1538594348_1_81D21F8E-64D7-4ACB-962A-3CB331958491

DB Inspect:

[ddrillic]

I don't see any problems.

I would run first on the one of the indexers - ./splunk btool indexes list --debug

That would show you the entire set-up of your indexes. By default for indexes where repFactor was not defined you should see repFactor = 0.

From Managing Indexers and Clusters of Indexers
and for the sake of completeness

[harsmarvania57]

I guess you can assign repFactor = auto to existing indexes but I think only new buckets will be replicated to other indexers. I'll recommend to test this in test environment first.

[a238574]

I had read somewhere that it might not replicate existing buckets. Is there a way to get those buckets replicated