Deployment Architecture

Why New Index is disabled by default after creation?

andrewpagans
Path Finder

Hello,
after creation , the index is disabled by default (so to manually enable I need to restart server).
is there any setting that I can change in order to have the index enabled by default after creation?

In my local machine works well (Index enabled by default after creation).
Why in production Env is present this behavior (Index disabled by default after creation).

Thank you

Tags (1)
0 Karma

andrewpagans
Path Finder

I did these tests:

Local Machine:
- New Index created when adding Data--> monitor
- New index creared from Settings--> Indexes
In both cases the index is ready and enabled after creation, no need to restart.

Prod machine:
- New Index created when adding Data--> monitor : new index does not apper in the liste after creation. I need to go under Index setting enable and restart. after these procedures the index is visible in drop down list.
- New index creared from Settings--> Indexes : new index created appear disabled , so I need to enable and restart.

Thanks

0 Karma

valiquet
Contributor

Even on stand alone instance you need to restart. How did you create the index? Does in non prod you might have written to main index instead?

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...