A customer is migrating their existing Splunk Indexer from an old set of hardware to a new set of indexers. What is the earliest method to migrate the system?

Question

Options

• A
  1. Add new indexers to the cluster as peers, in the same site (if needed). 2. Ensure new indexers
• B
  1. Add new indexers to the cluster as peers, to a new site. 2. Ensure new indexers receive
• C
  1. Add new indexers to the cluster as peers, in the same site. 2. Update the replication factor by +1
• D
  1. Add new indexers to the cluster as new site. 2. Update cluster master (CM) server.conf to

• A
  67% (26)
• B
  10% (4)
• C
  18% (7)
• D
  5% (2)

Explanation

Option A is correct because adding new indexers as peers within the same site preserves the existing cluster topology and requires no architectural changes - it's the most straightforward, low-risk path that allows data to begin replicating to new hardware immediately without reconfiguring site settings.

Option B is wrong because adding peers to a new site introduces multisite clustering complexity unnecessarily; this requires updating server.conf with site-specific settings across the cluster, adding steps and delay to what should be a simple hardware swap.

Option C is wrong because artificially incrementing the replication factor during migration wastes storage and increases network overhead - you'd be replicating data more times than your policy requires just as a workaround, rather than using the cluster's built-in peer management.

Option D is wrong for the same reason as B - treating new hardware as a "new site" forces multisite reconfiguration on what is fundamentally a same-site hardware replacement, making it the most complex and slowest option.

Memory tip: Think "same site = same day." Adding peers to the same site is always the fastest migration path because it requires zero topology changes - the cluster master simply sees more peers and starts balancing buckets automatically.

No community discussion yet for this question.