Dear Splunkers,
I am performing migration of a multi site indexer cluster with 2 sites. RF=2, SF=2 with 1 copy of raw data and tsidx data in each site. Total 40 indexers with 20 indexers each per site.
Approach is as follows:
1. Bring up 40 new indexers, 20 each in new site
2. Put each of the 40 old indexers in detention
3. Configure forwarders to forward data only to new indexers
4. Do an indexer data rebalance
5. Offline indexers one by one in each site alternatively, with enforce counts enabled (indexers do need to support search heads as usual)
I am currently at step 5, problem is that offlining each indexer takes couple of hours. I am aware that lot of factors including not the least of which are hardware bound and the amount of data (~900T in total) plays a significant role here. Nevertheless I would like to know if there are still improvements that can be made here through Splunk configuration changes.
Appreciate your thoughts,
Thanks,
↧
