Splunk Enterprise

CM in maintenance is required to add indexers to an indexer cluster?

ptcrusher
Explorer

In our setup we have a searchhead cluster with no search affinity (site0) and a multisite indexer clusters (site1/site2).
Now its time for some expansion and although we already expanded the searchhead cluster it is a first for the indexer cluster.

Search Tier uses the cluster master (CM) to discover the indexers. Forwarding Tier uses the indexerDiscovery i.e. also uses the cluster master (CM) to discover the indexers.

The process to spawn a new indexer is pretty much automated by now and from the  https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Addclusterpeer it is easy to understand why a rebalance may be required. Only thing that bothers me a bit is that from the Forums there is a general guidance to putt the CM in maintenance mode (https://community.splunk.com/t5/Deployment-Architecture/Adding-a-new-indexer-to-the-indexer-cluster/...).


Any idea why it is recommended to put the CM in maintenance? Afaik the maintenance only stops the bucket fix-up operations? There's any other hidden operation that maintenance mode does?

What does maintenance mode makes for a better/safer procedure?

Labels (3)
0 Karma
1 Solution

somesoni2
Revered Legend

@ptcrusher

Enabling maintenance mode on CM is optional when adding new peer to the cluster. I (and other splunkers who suggest doing so) enable CM maintenance mode as best practice, so that any unforeseen issues while making changes to the cluster doesn't affect cluster functionality much.

View solution in original post

somesoni2
Revered Legend

@ptcrusher

Enabling maintenance mode on CM is optional when adding new peer to the cluster. I (and other splunkers who suggest doing so) enable CM maintenance mode as best practice, so that any unforeseen issues while making changes to the cluster doesn't affect cluster functionality much.

ptcrusher
Explorer

@somesoni2 could you kindly share your opinion on this matter?

0 Karma

brent_weaver
Builder

I have scaled index clusters for a while now and I never put it maint mode. Maint mode is more to protect replication should it be disrupted. You may however want to consider running a cluster rebalance to spread buckets out across the cluster.

hope this helps.

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more!  Faster Time to Value Managing and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...