Add a peer to the cluster

You can add peer nodes to the indexer cluster at any time. To do so, just enable a Splunk Enterprise instance as a peer node.

Before you enable a peer node, familiarize yourself with the relevant system requirements, detailed in System requirements and other deployment considerations for indexer clusters. Ensure that the Splunk Enterprise instance meets the version compatibility and all other documented requirements.

For single-site clusters, follow one of these procedures:

• To enable a peer node with the Splunk Web dashboard, see Enable the peer nodes.
• To enable a peer node with the CLI , see Configure peer nodes with the CLI.
• To enable a peer node by editing server.conf, see Configure peer nodes with server.conf.

To enable a peer node for a multisite cluster, see Configure multisite indexer clusters with server.conf.

When the peer starts up, the manager node distributes the latest configuration bundle to the peer. This process ensures that the new peer has the same set of configurations, including the set of indexes and other index settings, as the other peer nodes. See Distribution of the bundle when a peer starts up.

After you enable the peer node, you might need to take steps to ensure that the peer is receiving data from forwarders. There are a variety of ways to configure the relationship between forwarders and peer nodes. Depending on how your cluster connects to forwarders, you might need to configure either the new peer node or the forwarders, or both. For details, read the topics in the chapter Get data into the indexer cluster.

As a final step, consider rebalancing the cluster's data, so that existing data gets moved onto the new peer node. This allows the new peer to share the search burden. See Rebalance indexer cluster data.