Deployment Architecture

Why New Index is disabled by default after creation?

andrewpagans
Path Finder

Hello,
after creation , the index is disabled by default (so to manually enable I need to restart server).
is there any setting that I can change in order to have the index enabled by default after creation?

In my local machine works well (Index enabled by default after creation).
Why in production Env is present this behavior (Index disabled by default after creation).

Thank you

Tags (1)
0 Karma

andrewpagans
Path Finder

I did these tests:

Local Machine:
- New Index created when adding Data--> monitor
- New index creared from Settings--> Indexes
In both cases the index is ready and enabled after creation, no need to restart.

Prod machine:
- New Index created when adding Data--> monitor : new index does not apper in the liste after creation. I need to go under Index setting enable and restart. after these procedures the index is visible in drop down list.
- New index creared from Settings--> Indexes : new index created appear disabled , so I need to enable and restart.

Thanks

0 Karma

valiquet
Contributor

Even on stand alone instance you need to restart. How did you create the index? Does in non prod you might have written to main index instead?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...