Installation

After updating a system to 7.2 and changing the tsidxWritingLevel value to 2, will existing indexes be regenerated to the new format?

simpkins1958
Contributor

After updating a system from 7.1 to 7.2 and changing the tsidxWritingLevel value to 2, will existing indexes be regenerated to the new format?

The text below is from Splunk docs...

http://docs.splunk.com/Documentation/Splunk/7.2.0/Installation/AboutupgradingREADTHISFIRST

Significant tsidx performance improvements are turned off by default
Splunk Enterprise 7.2 introduces a change to the file format of tsidx index files, resulting in significant size reduction. The reduced file size leads to improved search performance through decreased I/O, improved utilization of SmartSearch caches, and so on.

This change is beneficial under all circumstances. However, to upgrade multisite indexer clusters without search interruption, it is necessary to defer the format change until after the upgrade completes and all peer nodes can switch to the new format simultaneously. For this reason, Splunk Enterprise 7.2 ships with the feature turned off by default.

Turn this feature on, immediately after you complete your 7.2 upgrade.

To turn on the feature, edit indexes.conf on each indexer (or, in the case of indexer clusters, in the master node's configuration bundle). Set tsidxWritingLevel to 2. Make this change in the default section of the file, so that it applies to all indexes:

[default]
tsidxWritingLevel=2

rkantamaneni_sp
Splunk Employee
Splunk Employee

"Existing tsidx files will have the same older format, they won't be converted... But search works transparently across both types" via @Vishal Patel

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...