Migrate non-clustered indexers to a clustered environment
Read the topic "Key differences between clustered and non-clustered Splunk deployments" carefully if you plan to migrate your current set of indexers to a cluster. That topic describes issues that you must understand before initiating the migration process.
You can add a non-clustered indexer to a cluster (as a peer node) at any time. To do so, just enable the indexer as a peer, as described in "Enable the peer nodes".
Once the indexer has been made a peer, it participates in the cluster the same as any other peer. Any new data coming into the peer gets replicated according to the cluster's replication factor, and the peer is also a candidate for receiving replicated data from other peers. Data already on the indexer does not get automatically replicated, but it does participate in searches, as described below.
How the cluster handles legacy indexed data
When you add an existing indexer to the cluster, the cluster does not replicate any buckets that are already on the indexer.
Buckets already on the indexer prior to its being added to the cluster are called "standalone" buckets. Searches will still occur across those buckets and will be combined with search results from the cluster's replicated buckets.
Is there any way to migrate my legacy data?
Because of the high processing cost of converting standalone buckets to replicated buckets (due to the need to make multiple searchable and non-searchable copies of those buckets to fulfill the cluster's replication and search factors), it is generally a bad idea to attempt to do so, particularly in the case of indexers with large numbers of standalone buckets. There is no supported procedure for this conversion. If you are interested in having this performed, please contact Splunk Professional Services to discuss the trade-offs and requirements for this operation.
Use clusters to scale indexing
Configure the master
This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1