Indexers in a multiple-server deployment

This topic provides information about how Indexers function in a multiple-server deployment. Deploying multiple Indexers in your environment can be helpful to support better performance and longer data retention period.

When you deploy more than one Indexer, the Indexer that you install for the first time (on the primary node) must be the master. All other Indexers are considered as peers and they must be provided with details of the master. If you upgrade to the new version of the product, the initial Indexer is automatically considered as the master.

The master plays an important role of the coordinator. The master Indexer (installed on the primary node) communicates and coordinates with the peer Indexers.

The data collected is stored across all the Indexers. If the master goes down, the indexing and search functions stop working and you might experience data loss. If any of the peers go down then the indexing and search functions continue to work, but you might experience partial data loss.

When a peer goes offline temporarily, the data held by the peer is not available for search, for the time when the peer is offline. The peer can go offline due to various reasons, for example, network issues. After the peer comes online, the past data held by the peer becomes available for search. But during the time when the peer is offline, the data collectors are unable to connect and send data (for indexing) to the peer. Data sent to the peer in the time when it was offline is lost.

Each time you want to shut down an Indexer node, use the shutdown CLI command to stop all the Indexers, instead of stopping individual Indexer nodes. This is important to avoid data loss and performance degradation.