Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Download manual as PDF

Download topic as PDF

Add a peer to the cluster

You can add peer nodes to the indexer cluster at any time. To do so, just enable a Splunk Enterprise instance as a peer node.

Before you enable a peer node, familiarize yourself with the relevant system requirements, detailed in System requirements and other deployment considerations for indexer clusters. Ensure that the Splunk Enterprise instance meets the version compatibility and all other documented requirements.

For single-site clusters, follow one of these procedures:

To enable a peer node for a multisite cluster, see Configure multisite indexer clusters with server.conf.

When the peer starts up, the manager node distributes the latest configuration bundle to the peer. This process ensures that the new peer has the same set of configurations, including the set of indexes and other index settings, as the other peer nodes. See Distribution of the bundle when a peer starts up.

After you enable the peer node, you might need to take steps to ensure that the peer is receiving data from forwarders. There are a variety of ways to configure the relationship between forwarders and peer nodes. Depending on how your cluster connects to forwarders, you might need to configure either the new peer node or the forwarders, or both. For details, read the topics in the chapter Get data into the indexer cluster.

As a final step, consider rebalancing the cluster's data, so that existing data gets moved onto the new peer node. This allows the new peer to share the search burden. See Rebalance indexer cluster data.

Last modified on 05 October, 2020
PREVIOUS
Use the monitoring console to view indexer cluster status
  NEXT
Take a peer offline

This documentation applies to the following versions of Splunk® Enterprise: 8.1.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters