Getting Data In

How is it possible to move indexers to different site in same cluster

bfarr
Loves-to-Learn

I had 6 indexers in a cluster in 2 sites A and B. One of the admins(through scripting) configured 6 more indexers but accidentally added them all to site A instead of distributing them evenly(this was 2 weeks ago so there is lots of data on them already).

To distribute them evenly - 6 in site A and 6 in site B - is this as simple as:

  • enable maintenance mode
  • change the site in server.conf to the 3 I want moved to site B
  • disable maintenance mode
  • rebalance?

It seems too easy so I am hesitant.

We run the sites as such:
multisite = true
replication_factor = 2
site_replication_factor = origin:1,siteA:1,siteB:1,total:2
site_search_factor = origin:1,siteA:1,siteB:1,total:2

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's a little more involved than that. The process is documented at https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Moveapeertoanewsite. It describes a physical move to a different location, but the concept is the same.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...