We are looking to upgrade our Splunk Indexers to a set of more performant AWS instances with more disk space available to them.
I was reading about data rebalancing and it said that it makes the assumption that the amount of disk space available was the same across all instances.
I was wondering if the following is possible:
1. Add the new larger index nodes to the index cluster
2. Start a data rebalance to have the data distributed across all now 5 nodes
3. Remove the original two smaller indexers
I understand that an alternative step might be to just rsync the data to the new nodes and pivot, but I would like to avoid the down time if I can.
↧