Splunk Enterprise

CM in maintenance is required to add indexers to an indexer cluster?

ptcrusher
Explorer

In our setup we have a searchhead cluster with no search affinity (site0) and a multisite indexer clusters (site1/site2).
Now its time for some expansion and although we already expanded the searchhead cluster it is a first for the indexer cluster.

Search Tier uses the cluster master (CM) to discover the indexers. Forwarding Tier uses the indexerDiscovery i.e. also uses the cluster master (CM) to discover the indexers.

The process to spawn a new indexer is pretty much automated by now and from the  https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Addclusterpeer it is easy to understand why a rebalance may be required. Only thing that bothers me a bit is that from the Forums there is a general guidance to putt the CM in maintenance mode (https://community.splunk.com/t5/Deployment-Architecture/Adding-a-new-indexer-to-the-indexer-cluster/...).


Any idea why it is recommended to put the CM in maintenance? Afaik the maintenance only stops the bucket fix-up operations? There's any other hidden operation that maintenance mode does?

What does maintenance mode makes for a better/safer procedure?

Labels (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

@ptcrusher

Enabling maintenance mode on CM is optional when adding new peer to the cluster. I (and other splunkers who suggest doing so) enable CM maintenance mode as best practice, so that any unforeseen issues while making changes to the cluster doesn't affect cluster functionality much.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

@ptcrusher

Enabling maintenance mode on CM is optional when adding new peer to the cluster. I (and other splunkers who suggest doing so) enable CM maintenance mode as best practice, so that any unforeseen issues while making changes to the cluster doesn't affect cluster functionality much.

ptcrusher
Explorer

@somesoni2 could you kindly share your opinion on this matter?

0 Karma

brent_weaver
Builder

I have scaled index clusters for a while now and I never put it maint mode. Maint mode is more to protect replication should it be disrupted. You may however want to consider running a cluster rebalance to spread buckets out across the cluster.

hope this helps.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...