Will hot bucket once full not move to warm if Maintenance mode is enabled for many hours ?

[ankuragnihotri8]

If Maintenance mode is enabled in Splunk Indexer Cluster for suppose continuous 10 hours, Incoming data volume is very high and Hot Buckets are getting full for one very high volume index, will hot bucket move to warm or It can't move to Warm due to enabled maintenance mode and what happen to hot bucket data if this will be the case ?

[isoutamo]

Hi

First I'm never keeping cluster continuously on maintenance mode so long that this has been a issue. Usually you can switch maintenance mode on and off several times in your maintenance windows.

Spunk's docs said that when maintenance mode is enabled there is no bucket fixup operations including rolling from hot to warm. Basically this means that when all hot buckets has filled up then indexing will stop.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Usemaintenancemode

r. Ismo

[ankuragnihotri8]

Hi Soutamo, Thanks for response, What if we have situation where cluster reboot is required and it takes 5 hours to complete, I have to keep maintenance mode on for all time during complete reboot period and till all peers reports up and searchable in Cluster Master.

is there a way to check if any of my indexer's any index has stopped indexing data in its hot bucket because they are full and unable to rotate to warm ?

[isoutamo]

When you are doing rolling-restart for cluster you don't (shouldn't) need to enable maintenance mode you yourself. Cluster master manages it.

You should see that on MC (monitoring console) under Indexing tab.
r. Ismo