Convert a multisite indexer cluster to single-site
You can convert a multisite indexer cluster to a basic, single-site cluster. When you do so, all peers and search heads become part of the implicit single site.
1. Stop all cluster nodes (manager/peers/search heads).
2. On the manager node, edit server.conf
:
- a. Set
multisite
tofalse
.
- b. Set the single-site
replication_factor
andsearch_factor
attributes to implement the desired replication behavior.
- c. Remove the
site
attribute.
3. On each search head, edit server.conf
:
- a. Set
multisite
tofalse
.
- b. Remove the
site
attribute.
4. On each peer, edit server.conf
:
- a. Remove the
site
attribute.
5. Start the manager node.
6. Start the peer nodes and search heads.
Note the following:
- The manager ignores any multisite attributes remaining in
server.conf
(site_replication_factor
and so on).
- Upon restart, the manager picks a primary copy for each bucket.
- After the conversion, any bucket copies that exceed the single-site replication factor remain in place. For information on removing these extra copies, see Remove excess bucket copies.
- Future bucket replication and bucket fixing will follow the values set for the single-site replication and search factors.
For information on how to convert a single-site cluster to multisite, see Migrate an indexer cluster from single-site to multisite.
Restart indexing in multisite cluster after manager restart or site failure | Move a peer to a new site |
This documentation applies to the following versions of Splunk® Enterprise: 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2
Feedback submitted, thanks!