Deployment Architecture

Why New Index is disabled by default after creation?

andrewpagans
Path Finder

Hello,
after creation , the index is disabled by default (so to manually enable I need to restart server).
is there any setting that I can change in order to have the index enabled by default after creation?

In my local machine works well (Index enabled by default after creation).
Why in production Env is present this behavior (Index disabled by default after creation).

Thank you

Tags (1)
0 Karma

andrewpagans
Path Finder

I did these tests:

Local Machine:
- New Index created when adding Data--> monitor
- New index creared from Settings--> Indexes
In both cases the index is ready and enabled after creation, no need to restart.

Prod machine:
- New Index created when adding Data--> monitor : new index does not apper in the liste after creation. I need to go under Index setting enable and restart. after these procedures the index is visible in drop down list.
- New index creared from Settings--> Indexes : new index created appear disabled , so I need to enable and restart.

Thanks

0 Karma

valiquet
Contributor

Even on stand alone instance you need to restart. How did you create the index? Does in non prod you might have written to main index instead?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...