Deployment Architecture

Will hot bucket once full not move to warm if Maintenance mode is enabled for many hours ?

ankuragnihotri8
Engager

If Maintenance mode is enabled in Splunk Indexer Cluster for suppose continuous 10 hours, Incoming data volume is very high and Hot Buckets are getting full for one very high volume index, will hot bucket move to warm or It can't move to Warm due to enabled maintenance mode and what happen to hot bucket data if this will be the case ?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

First I'm never keeping cluster continuously on maintenance mode so long that this has been a issue. Usually you can switch maintenance mode on and off several times in your maintenance windows.

Spunk's docs said that when maintenance mode is enabled there is no bucket fixup operations including rolling from hot to warm. Basically this means that when all hot buckets has filled up then indexing will stop.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Usemaintenancemode

r. Ismo

0 Karma

ankuragnihotri8
Engager

Hi Soutamo, Thanks for response, What if we have situation where cluster reboot is required and it takes 5 hours to complete, I have to keep maintenance mode on for all time during complete reboot period and till all peers reports up and searchable in Cluster Master.

is there a way to check if any of my indexer's any index has stopped indexing data in its hot bucket because they are full and unable to rotate to warm ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
When you are doing rolling-restart for cluster you don't (shouldn't) need to enable maintenance mode you yourself. Cluster master manages it.

You should see that on MC (monitoring console) under Indexing tab.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...