Convert a multisite indexer cluster to single-site
You can convert a multisite indexer cluster to a basic, single-site cluster. When you do so, all peers and search heads become part of the implicit single site.
1. Stop all cluster nodes (master/peers/search heads).
2. On the master, edit server.conf:
- a. Set
multisitetofalse.
- b. Set the single-site
replication_factorandsearch_factorattributes to implement the desired replication behavior.
- c. Remove the
siteattribute.
3. On each search head, edit server.conf:
- a. Set
multisitetofalse.
- b. Remove the
siteattribute.
4. On each peer, edit server.conf:
- a. Remove the
siteattribute.
5. Start the master node.
6. Start the peer nodes and search heads.
Note the following:
- The master ignores any multisite attributes remaining in
server.conf(site_replication_factorand so on).
- Upon restart, the master picks a primary copy for each bucket.
- After the conversion, any bucket copies that exceed the single-site replication factor remain in place. For information on removing these extra copies, see Remove excess bucket copies.
- Future bucket replication and bucket fixing will follow the values set for the single-site replication and search factors.
For information on how to convert a single-site cluster to multisite, see Migrate an indexer cluster from single-site to multisite.
| Restart indexing in multisite cluster after master restart or site failure | Move a peer to a new site |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10
Download manual
Feedback submitted, thanks!