We have an on premises Splunk infrastructure with indexers that have 9 TB of usable storage in a cluster. We are moving from 6 months retention to 1 year retention and need to double our storage. Is it possible to run a cluster with varying amounts of storage in our indexers and make use of it?
e.g. We could add new indexers with 30 TB of usable storage, but would the cluster be able to use any of the 21 TB beyond what we're using on the existing indexers? It's basically just cold storage of data older than six months. Any documentation that specifies whether or not this works?
↧