Need to Data Balancing after upsizing

[krushivasani]

Need to Data Balancing after upsizing of indexer ??

[PickleRick]

Maybe.

But seriously - depends on your environment (mind you that you posted in Splunk Cloud section).

Do you have single indexer (where would you rebalance data then?), distributed search, indexer cluster?

Also depends on what you mean by "upsizing". Adding more resources to existing machine(s)? Adding new indexer instances?

[krushivasani]

I am talking about incresing the instance size from i3.4xlarge to i3.8xlarge.

[PickleRick]

OK. So it's not a Splunk Cloud service but simply your Splunk Enterprise installation in AWS, right?

If it's just a single instance installation and you upscaled (added resources), there is nothing to rebalance. Rebalancing is a process of moving the buckets between members of the cluster. If you have just a single instance, there is no cluster, there are no nodes between which you could move the data. So there is no possibility of rebalancing.

[krushivasani]

It's the Clustering of three indexer.

[PickleRick]

Yes, but you only upscaled the machines, not added new ones to the cluster, right? So the data distribution is as it was before.

You might want to rebalance buckets if you're changing the number of cluster members. If it's just that you added more space to every indexer, nothing changes.