topic Re: Issues with data rebalance from cluster master in Deployment Architecture

Issues with data rebalance from cluster master

athorat — Thu, 21 Sep 2017 06:37:01 GMT

When I use the Data rebalance option from the Cluster master, it shows that it is complete within 10-20 mins
Do not see any data moved from the old indexers to the new indexers which are added in the indexer cluster

Also tried to use :
splunk rebalance cluster-data -action start

and has the same result.

in the UI >> Under the Data Rebalance option>> when I click on "All Indexes" >> it shows only _(indexes)

How do I add all the indexes, pretty sure even the command line is replicating only _internal indexes.

Re: Issues with data rebalance from cluster master

support0 — Fri, 10 Nov 2017 09:44:43 GMT

Hello,

I had the same issue.

6.5.3

Actually, when you first go to Indexer Clustering Section and select Data Rebalance, and select index : it shows only the 10 first indexes.

But if you go to Indexes, and switch from displaying 10per page to more, then all indexes are displayed in Data Rebalance > Indexes

May be it has been fixed since then.

Re: Issues with data rebalance from cluster master

jmantor — Mon, 12 Mar 2018 14:26:38 GMT

I've just run into something simmilar on Splunk 6.5.6.
We recently added 3 new indexers to a cluster that had 15 Indexers, one at a time and re-balanced the data after each one was brought up. The first two worked just fine, but the third just doesn't seem to get any buckets? The other 17 indexers all have 17-19K+ buckets but, the newest it only has about 200, even after the re-balance has run all weekend long.

Re: Issues with data rebalance from cluster master

tfechner — Thu, 23 Aug 2018 09:08:09 GMT

same here on 7.1.2: only first 10 indexes are listed

Re: Issues with data rebalance from cluster master

jmantor — Thu, 23 Aug 2018 13:46:54 GMT

There are some bugs in that feature. We've found that we have to restart our cluster master when the data re-balance just seems to get stuck : (

Re: Issues with data rebalance from cluster master

halbeisendv — Sat, 27 Oct 2018 13:24:24 GMT

"bugs in that feature?" Has Splunk Technical Support responded to this issue?

We added five indexers; attempted to rebalance one index. The process stopped at 15%. We restarted the Master, attempted to rebalance, but the process stopped at 15% again.