When I use the Data rebalance option from the Cluster master, it shows that it is complete within 10-20 mins
Do not see any data moved from the old indexers to the new indexers which are added in the indexer cluster
Also tried to use :
splunk rebalance cluster-data -action start
and has the same result.
in the UI >> Under the Data Rebalance option>> when I click on "All Indexes" >> it shows only _(indexes)
How do I add all the indexes, pretty sure even the command line is replicating only _internal indexes.
I've just run into something simmilar on Splunk 6.5.6.
We recently added 3 new indexers to a cluster that had 15 Indexers, one at a time and re-balanced the data after each one was brought up. The first two worked just fine, but the third just doesn't seem to get any buckets? The other 17 indexers all have 17-19K+ buckets but, the newest it only has about 200, even after the re-balance has run all weekend long.