topic Re: config changes indexes.conf - restart query in Splunk Enterprise

config changes indexes.conf - restart query

goelt2000 — Sat, 14 Aug 2021 00:25:38 GMT

Hi All,

Do we need an indexer restart in non clustered search peers for these changes?

Is reloading not enough?

https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Determinerestart

in particular "coldPath.maxDataSizeMB" and "Enabling or disabling an index that contains data"

I don't think Splunk throws any errors or blocks subsequent indexes.conf changes when this happens. I need to check the logs, when any change is made in coldPath.maxDataSizeMB. But I am sure when disabling an index, the things go smooth without a restart. Why do we need a restart then?

Thanks!

Re: config changes indexes.conf - restart query

codebuilder — Wed, 18 Aug 2021 18:56:13 GMT

If you push out a new index then a restart/rolling restart of the indexers is not necessary.

If you make any changes to indexes.conf (other than a new index) the a restart is required (rolling restart for indexer cluster).

For an indexer cluster you need to use the master for bundle verification and push.

Re: config changes indexes.conf - restart query

goelt2000 — Thu, 19 Aug 2021 19:06:01 GMT

Thanks for the reply. the indexes.conf documentation does not say to restart it though when we disable.

Am I missing something?

https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Indexesconf

Thanks!

Re: config changes indexes.conf - restart query

codebuilder — Thu, 19 Aug 2021 19:20:34 GMT

Disabling an index does not require a restart, along with creating a new one (as I mentioned). Those are the two exceptions. Any other parameter changes require restart. The master will let you know if rolling restart is required after bundle validation.