Help with changing tsidxWritingLevel

[splunk_noob2022]

Hello Splunkers / @DavidHourani 

We have a single site indexer cluster with 2 Indexers which are having storage issues so we decided to apply below parameters.

We are currently on Splunk version 8.1.7

1. tsidxWritingLevel = 4

2. enableTsidxReduction = true

3. timePeriodInSecBeforeTsidxReduction = 7890000

The issue here is from cluster Master i can see RF/SF is not met and 1 of the IDX is in Automatic-detention mode, so in this scenario what challenges will i face if above parameters are enabled for all the existing indexes.

Splunk docs doesn't tell much about RF/SF with these parameters.

[DavidHourani · Accepted solution]

Hi @splunk_noob2022 ,

If an indexer has just gone into detention then most likely the "RF/SF not met" issue is linked to the CM trying to rebuild the buckets lost along with that indexer.

The parameters you posted are simply tuning for the indexes configuration and shouldn't have any effect on RF/SF being met.

Could you please check in your internal logs for the indexer that is in delention to see what other issues could be causing this?

Cheers,

David