Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Convert a multisite indexer cluster to single-site

You can convert a multisite indexer cluster to a basic, single-site cluster. When you do so, all peers and search heads become part of the implicit single site.

1. Stop all cluster nodes (master/peers/search heads).

2. On the master, edit server.conf:

a. Set multisite to false.
b. Set the single-site replication_factor and search_factor attributes to implement the desired replication behavior.
c. Remove the site attribute.

3. On each search head, edit server.conf:

a. Set multisite to false.
b. Remove the site attribute.

4. On each peer, edit server.conf:

a. Remove the site attribute.

5. Start the master node.

6. Start the peer nodes and search heads.

Note the following:

  • The master ignores any multisite attributes remaining in server.conf (site_replication_factor and so on).
  • Upon restart, the master picks a primary copy for each bucket.
  • After the conversion, any bucket copies that exceed the single-site replication factor remain in place. For information on removing these extra copies, see Remove excess bucket copies.
  • Future bucket replication and bucket fixing will follow the values set for the single-site replication and search factors.

For information on how to convert a single-site cluster to multisite, see Migrate an indexer cluster from single-site to multisite.

Last modified on 05 October, 2020
PREVIOUS
Restart indexing in multisite cluster after master restart or site failure 		  NEXT
Move a peer to a new site

This documentation applies to the following versions of Splunk® Enterprise: 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters