Splunk Enterprise

CM in maintenance is required to add indexers to an indexer cluster?

ptcrusher
Explorer

In our setup we have a searchhead cluster with no search affinity (site0) and a multisite indexer clusters (site1/site2).
Now its time for some expansion and although we already expanded the searchhead cluster it is a first for the indexer cluster.

Search Tier uses the cluster master (CM) to discover the indexers. Forwarding Tier uses the indexerDiscovery i.e. also uses the cluster master (CM) to discover the indexers.

The process to spawn a new indexer is pretty much automated by now and from the  https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Addclusterpeer it is easy to understand why a rebalance may be required. Only thing that bothers me a bit is that from the Forums there is a general guidance to putt the CM in maintenance mode (https://community.splunk.com/t5/Deployment-Architecture/Adding-a-new-indexer-to-the-indexer-cluster/...).


Any idea why it is recommended to put the CM in maintenance? Afaik the maintenance only stops the bucket fix-up operations? There's any other hidden operation that maintenance mode does?

What does maintenance mode makes for a better/safer procedure?

Labels (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

@ptcrusher

Enabling maintenance mode on CM is optional when adding new peer to the cluster. I (and other splunkers who suggest doing so) enable CM maintenance mode as best practice, so that any unforeseen issues while making changes to the cluster doesn't affect cluster functionality much.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

@ptcrusher

Enabling maintenance mode on CM is optional when adding new peer to the cluster. I (and other splunkers who suggest doing so) enable CM maintenance mode as best practice, so that any unforeseen issues while making changes to the cluster doesn't affect cluster functionality much.

ptcrusher
Explorer

@somesoni2 could you kindly share your opinion on this matter?

0 Karma

brent_weaver
Builder

I have scaled index clusters for a while now and I never put it maint mode. Maint mode is more to protect replication should it be disrupted. You may however want to consider running a cluster rebalance to spread buckets out across the cluster.

hope this helps.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...