CM in maintenance is required to add indexers to an indexer cluster?

[ptcrusher]

In our setup we have a searchhead cluster with no search affinity (site0) and a multisite indexer clusters (site1/site2).
Now its time for some expansion and although we already expanded the searchhead cluster it is a first for the indexer cluster.

Search Tier uses the cluster master (CM) to discover the indexers. Forwarding Tier uses the indexerDiscovery i.e. also uses the cluster master (CM) to discover the indexers.

The process to spawn a new indexer is pretty much automated by now and from the  https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Addclusterpeer it is easy to understand why a rebalance may be required. Only thing that bothers me a bit is that from the Forums there is a general guidance to putt the CM in maintenance mode (https://community.splunk.com/t5/Deployment-Architecture/Adding-a-new-indexer-to-the-indexer-cluster/...).

Any idea why it is recommended to put the CM in maintenance? Afaik the maintenance only stops the bucket fix-up operations? There's any other hidden operation that maintenance mode does?

What does maintenance mode makes for a better/safer procedure?

[somesoni2 · Accepted solution]

@ptcrusher

Enabling maintenance mode on CM is optional when adding new peer to the cluster. I (and other splunkers who suggest doing so) enable CM maintenance mode as best practice, so that any unforeseen issues while making changes to the cluster doesn't affect cluster functionality much.

[ptcrusher]

@somesoni2 could you kindly share your opinion on this matter?

[brent_weaver]

I have scaled index clusters for a while now and I never put it maint mode. Maint mode is more to protect replication should it be disrupted. You may however want to consider running a cluster rebalance to spread buckets out across the cluster.

hope this helps.