i know this has been asked before, such as https://answers.splunk.com/answers/432048/is-there-a-way-to-migrate-indexed-data-from-a-lega.html - but looking for clarification on replication and search factors.
If I were to start a 3-node indexer cluster with rf and sf set to 3, and copied all the buckets from the specific indexes to all nodes (including raw and index files), would all the historical data be searchable across the indexer cluster? i.e. is it enough to copy all the files there.
1 additional item to mention is that i may want to look at smartstore for some of the indexes, e.g. using S3, but still investigating the search usage to get a better idea of how far back data is being used and whether this might have a negative performance impact - if not, this is the way we'd want to go, and i believe sf/rf of 3 with 3 indexers would be needed for this.
splunk version is 7.3.1
↧