According to the Splunk documentation1, when migrating an indexer cluster from single-site to multi-site, you must remove the existing single-site attributes from the server.conf file of each peer node. These attributes include replication_factor, search_factor, and cluster_label. You must also restart each peer node after removing the attributes. The other options are false because:
Multi-site policies will apply only to the data created after migration, unless you configure the manager node to convert legacy buckets to multi-site1.
All peer nodes do not need to run the same version of Splunk, as long as they are compatible with the manager node2.
Single-site buckets can be converted to multi-site buckets by changing the constrain_singlesite_buckets setting in the manager node’s server.conf file to "false"1.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit