Deployment Architecture

Issues with data rebalance from cluster master


When I use the Data rebalance option from the Cluster master, it shows that it is complete within 10-20 mins
Do not see any data moved from the old indexers to the new indexers which are added in the indexer cluster

Also tried to use :
splunk rebalance cluster-data -action start

and has the same result.

in the UI >> Under the Data Rebalance option>> when I click on "All Indexes" >> it shows only _(indexes)

How do I add all the indexes, pretty sure even the command line is replicating only _internal indexes.

0 Karma

Path Finder

There are some bugs in that feature. We've found that we have to restart our cluster master when the data re-balance just seems to get stuck : (

0 Karma

Path Finder

"bugs in that feature?" Has Splunk Technical Support responded to this issue?

We added five indexers; attempted to rebalance one index. The process stopped at 15%. We restarted the Master, attempted to rebalance, but the process stopped at 15% again.

0 Karma

Path Finder

same here on 7.1.2: only first 10 indexes are listed

0 Karma

Path Finder

I've just run into something simmilar on Splunk 6.5.6.
We recently added 3 new indexers to a cluster that had 15 Indexers, one at a time and re-balanced the data after each one was brought up. The first two worked just fine, but the third just doesn't seem to get any buckets? The other 17 indexers all have 17-19K+ buckets but, the newest it only has about 200, even after the re-balance has run all weekend long.

0 Karma

Path Finder


I had the same issue.


Actually, when you first go to Indexer Clustering Section and select Data Rebalance, and select index : it shows only the 10 first indexes.

But if you go to Indexes, and switch from displaying 10per page to more, then all indexes are displayed in Data Rebalance > Indexes

May be it has been fixed since then.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...