topic Re: Does putting indexer into manual detention roll active hot buckets? in Splunk Enterprise

Does putting indexer into manual detention roll active hot buckets?

kozanic_mg — Thu, 23 Jul 2020 03:35:55 GMT

Hi All,

We are trying to work out the best method for rolling our Indexer stack in AWS.

We have recently migrated to Smartstore and 1 week after migration had a number of indexers autoheal which resulted in corrupted buckets all over the place.

Our current thought is to put indexers into manual detention mode prior to the stack roll, but not sure if this forces a bucket roll and replication to S3 or if there is another step required to force this action.

Re: Does putting indexer into manual detention roll active hot buckets?

richgalloway — Thu, 23 Jul 2020 13:31:35 GMT

Buckets are not rolled by putting an indexer into manual detention.
It sounds like auto healing is not a good idea for indexers.

Re: Does putting indexer into manual detention roll active hot buckets?

isoutamo — Thu, 23 Jul 2020 21:27:00 GMT

here is describing how to roll hot buckets of index X to warm: https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Backupindexeddata#Rolling_buckets_manually_from_hot_to_warm

r. Ismo

Re: Does putting indexer into manual detention roll active hot buckets?

kozanic_mg — Thu, 23 Jul 2020 22:29:29 GMT

Thanks Rich - exactly the answer I was after.

Agreed on the autoheal, unfortunately for our situation we don't have any choice so will need to look into how best we can manage the process.

Re: Does putting indexer into manual detention roll active hot buckets?

kozanic_mg — Thu, 23 Jul 2020 22:32:01 GMT

thanks @isoutamo ,

Do you know whether we can use a wildcard option with is command?

IE:

splunk _internal call /data/indexes/*/roll-hot-buckets

I have been advised that this should work, but we are currently having issues with our non prod environment and so haven't been able to test to confirm.