We've recently added 50% more indexers. After rebalancing the cluster, we're finding that we still have a gap on our hot/warm storage where, the new indexers have maybe 2 or 3 warm buckets, and the older ones have maybe 20 or 30. The splunk rebalance cluster-data
command has definitely evened the total bucket counts between the indexers, but is there a way to balance only the warm buckets? (I believe the answer to that is 'no').
One way would be to do a rolling restart at off peak to reduce the number of warm-hot buckets and then invoke rebalance command.