Splunk Enterprise

CM in maintenance is required to add indexers to an indexer cluster?

ptcrusher
Explorer

In our setup we have a searchhead cluster with no search affinity (site0) and a multisite indexer clusters (site1/site2).
Now its time for some expansion and although we already expanded the searchhead cluster it is a first for the indexer cluster.

Search Tier uses the cluster master (CM) to discover the indexers. Forwarding Tier uses the indexerDiscovery i.e. also uses the cluster master (CM) to discover the indexers.

The process to spawn a new indexer is pretty much automated by now and from the  https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Addclusterpeer it is easy to understand why a rebalance may be required. Only thing that bothers me a bit is that from the Forums there is a general guidance to putt the CM in maintenance mode (https://community.splunk.com/t5/Deployment-Architecture/Adding-a-new-indexer-to-the-indexer-cluster/...).


Any idea why it is recommended to put the CM in maintenance? Afaik the maintenance only stops the bucket fix-up operations? There's any other hidden operation that maintenance mode does?

What does maintenance mode makes for a better/safer procedure?

Labels (3)
0 Karma
1 Solution

somesoni2
Revered Legend

@ptcrusher

Enabling maintenance mode on CM is optional when adding new peer to the cluster. I (and other splunkers who suggest doing so) enable CM maintenance mode as best practice, so that any unforeseen issues while making changes to the cluster doesn't affect cluster functionality much.

View solution in original post

somesoni2
Revered Legend

@ptcrusher

Enabling maintenance mode on CM is optional when adding new peer to the cluster. I (and other splunkers who suggest doing so) enable CM maintenance mode as best practice, so that any unforeseen issues while making changes to the cluster doesn't affect cluster functionality much.

View solution in original post

ptcrusher
Explorer

@somesoni2 could you kindly share your opinion on this matter?

0 Karma

brent_weaver
Builder

I have scaled index clusters for a while now and I never put it maint mode. Maint mode is more to protect replication should it be disrupted. You may however want to consider running a cluster rebalance to spread buckets out across the cluster.

hope this helps.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!