[smartstore] Is it feasible to merge to separate smart-store. indexer into one?

[rbal_splunk]

I am curious if this may be possible:

2 indexer clusters which are using separate smart-store. Customer want to combine the 2 environments into a single indexer cluster.
- Both environments are on same splunk version 7.2.4.2
- Both use multi-site configuration with 3 sites each.
- One environment is 126 indexer and another is 18 indexer. Both environments has its own cluster master.
- Both environments have different index names expect for internal indexes.
Any idea?
3 replies

[rbal_splunk]

It is possible, but operationally non-trivial.

Probably best approach would be (moving from cluster1 to cluster2) :
1) Stop ingest on cluster1
2) Roll all Splunk buckets on cluster 1, make sure they upload
3) Copy all Splunk buckets from cluster1's s3 location to cluster2's
4) Bootstrap cluster2

[wkpatrickdeutsc]

Is there any clarity on step 4. Like how to bootstrap one cluster2 with cluster 1's data. Or is all that is needed it to make the buckets available in the smartstore bucket?

[esix_splunk]

As stated, this should work. Much in a similar way as local storage would work, and similar caveats apply..

I'll add one more thought to this. The copy from Cluster 1's object store will need to be done outside of Splunk. So you'll have to rely on either AWS tools, or your storage admin's capabilities to copy from cluster1's s3 bucket to cluster2's bucket. Obviously you'll need to be considerate of potential name space collisions..

[rbal_splunk]

Thanks for elaborating further.

[srajarat2]

Alternatively, you can set up a new bucket for the second environment on the first S3 object store, replicate the data from the second S3 object store to first (assuming they are on similar object stores with replication enabled), include the new bucket under a new volume in indexes.conf.