Greetings,
This question refers to Splunk Enterprise version 6.3.x and has 2 parts. My task is to move my (indexer) cluster master from one machine to another without data loss and with as little disruption as possible.
I've already set up the new master. It is idling, waiting for peers to join.
I'd like to be able to move indexers over one by one, by removing each one from its existing cluster and adding it to the new one. May I do this if I first put both the old and new clusters in maintenance mode?
In this scenario, what's a good way to manage the search heads (not clustered)? I'm tempted to add the new cluster to each search head prior to enabling maintenance mode. What's gonna happen as each peer drops out of the old cluster and connects to the new one?
As always, all suggestions are greatly appreciated.
↧