Getting Data In

Index rebalance - How to rebalance only Warm Buckets


We've recently added 50% more indexers. After rebalancing the cluster, we're finding that we still have a gap on our hot/warm storage where, the new indexers have maybe 2 or 3 warm buckets, and the older ones have maybe 20 or 30. The splunk rebalance cluster-data command has definitely evened the total bucket counts between the indexers, but is there a way to balance only the warm buckets? (I believe the answer to that is 'no').

Tags (1)
0 Karma


One way would be to do a rolling restart at off peak to reduce the number of warm-hot buckets and then invoke rebalance command.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!