Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Splunk Enterprise version 8.2 is no longer supported as of September 30, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Convert a multisite indexer cluster to single-site

You can convert a multisite indexer cluster to a basic, single-site cluster. When you do so, all peers and search heads become part of the implicit single site.

1. Stop all cluster nodes (manager/peers/search heads).

2. On the manager node, edit server.conf:

a. Set multisite to false.
b. Set the single-site replication_factor and search_factor attributes to implement the desired replication behavior.
c. Remove the site attribute.

3. On each search head, edit server.conf:

a. Set multisite to false.
b. Remove the site attribute.

4. On each peer, edit server.conf:

a. Remove the site attribute.

5. Start the manager node.

6. Start the peer nodes and search heads.

Note the following:

  • The manager ignores any multisite attributes remaining in server.conf (site_replication_factor and so on).
  • Upon restart, the manager picks a primary copy for each bucket.
  • After the conversion, any bucket copies that exceed the single-site replication factor remain in place. For information on removing these extra copies, see Remove excess bucket copies.
  • Future bucket replication and bucket fixing will follow the values set for the single-site replication and search factors.

For information on how to convert a single-site cluster to multisite, see Migrate an indexer cluster from single-site to multisite.

Last modified on 05 October, 2020
Restart indexing in multisite cluster after manager restart or site failure   Move a peer to a new site

This documentation applies to the following versions of Splunk® Enterprise: 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2, 9.4.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters