I need to down size the number of indexers to half

[bapun18]

Hi Team,
I need to decrease the number of indexers used to half, in my current configurations we have site replication factor is 5 in total with origin:3 and site searchfactor is defined as 3 in total and origin:2.

My total number of indexers is 24 and I want to decrease the count of indexers to 12.

I want to have the complete process of reducing the indexer cluster size so that the buckets which have site information will not be impacted.

[gcusello]

Hi @bapun18 ,

The number of indexers depends on the daily indexed logs, on the number of scheduled searches and active users.

how many of them do you have?

can your reducted Indexers manage your volume?

In my opinion only a Splunk Architect can answer to this question.

Ciao.

Giuseppe 

[richgalloway]

Why do you want to reduce the number of indexers? 

What problem are you trying to solve? 

Can 12 indexers handle the workload currently done by 24 indexers?

[bapun18]

Yes, it can handle.. Data volume reduced, so there is no point of keeping 24 indexers. 

[richgalloway · Accepted solution]

Assuming you've verified 12 indexers can handle both the indexing and search loads, then you just need to remove 12 indexers. 

1. Remove 12 indexers from outputs.conf on all instances.  Ideally, you have this in an app so you can make the change once an push it to where it is needed (SHs, forwarders, DS, MC, CM, LM).  If you've implemented Indexer Discover then you can skip this step.

2. Put the 12 indexers into manual detention.  This will keep them from accepting new data or replicated buckets.

splunk edit cluster-config -auth <username>:<password> -manual_detention on

3. Run this command on each indexer being removed.

splunk offline --enforce-counts

Wait for the indexer to stop before proceeding to the next.