Getting Data In

When initiating an indexer cluster, why is the restart of indexers so slow?

ameslet
Explorer

Hi,

I have two indexers linked to a master node. Since I have linked both indexers to the master node, it takes forever to restart both of them. Does anyone know what is slowing the restart down down so much for my indexers and what can I do to fix it?

Thanks in advance,

Alex

0 Karma
1 Solution

woodcock
Esteemed Legend

Because every Indexer has to make copies of large portions of ALL EXISTING DATA and send copies to other indexers. This means each indexer is busy both sending and receiving a huge number of buckets.

View solution in original post

0 Karma

ddrillic
Ultra Champion

Alex, you can track the progress via the Indexer Clustering console on the replication server.

alt text

The progress depends on the Replication Factor and the Search Factor.

woodcock
Esteemed Legend

Because every Indexer has to make copies of large portions of ALL EXISTING DATA and send copies to other indexers. This means each indexer is busy both sending and receiving a huge number of buckets.

0 Karma

ameslet
Explorer

Okay I see. Is there any way to select the data every indexer send to the the others ?
For example, to tell the indexer to just make copies of data from the last month and send it to the other indexer.
I have data from a year ago in both of my indexers and I don't need them to copy so much of it.

0 Karma

woodcock
Esteemed Legend

I am not aware are any way to "selectively/partially" cluster index data. But you can set smaller retention periods on your index so that it gets deleted sooner. This way there is less to copy. Also, this problem will only really be a problem the first time that you start an indexer after bringing it into the cluster. Once the initial copies are done, later restarts should be much quicker.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...