Getting Data In

Index rebalance - How to rebalance only Warm Buckets

Contributor

We've recently added 50% more indexers. After rebalancing the cluster, we're finding that we still have a gap on our hot/warm storage where, the new indexers have maybe 2 or 3 warm buckets, and the older ones have maybe 20 or 30. The splunk rebalance cluster-data command has definitely evened the total bucket counts between the indexers, but is there a way to balance only the warm buckets? (I believe the answer to that is 'no').

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

One way would be to do a rolling restart at off peak to reduce the number of warm-hot buckets and then invoke rebalance command.

0 Karma