I have a kvstore down on a 4 member search head cluster.
I'd like to resync it without impacting too much the users activity.
I've got 2 options :
- put the instance in detention, stop it, clean the store, start it and put it out of detention
=> but I'm not sure how the new requests will be handled from the load balancer in front of the cluster...
- log in to the kvstore captain, and resync all => does that action launch a rolling restart ? does it affect the performance ? I couldn't find info on that.
I used mostly : https://docs.splunk.com/Documentation/Splunk/latest/Admin/ResyncKVstore
Thanks in advance,