Splunk Smartstore : Bucket status

[samadmemon]

Hi All,

We have  Indexer cluster configured on AWS EC2 Instances  which is configured with Smart store. Since this is a Dev environment we want to stop the EC2 instances in non-business hours.

Could you please advise if the when we stop an indexer with smart store, the hot buckets are rolled to warm and uploaded to the smart store before the indexer peer stops.

Also, what would be the recommended way to stop the splunk service before stopping the EC2 Instance, would it be using splunk stop command or splunk offline command.

[richgalloway]

Hot buckets roll to warm when the indexer *starts*, not when it stops.

To upload your data to S2 before stopping, use these steps.  They're just my opinion, not based on anything official.

1) Put the indexers into detention.  This stops incoming data and prevents new hot buckets.

2) Manually roll each index.  See https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Backupindexeddata#Rolling_buckets_manual...

3) Wait for the buckets to upload.

4) Stop the indexers using splunk stop