Splunk Enterprise

Does putting indexer into manual detention roll active hot buckets?

kozanic_mg
Explorer

Hi All,

We are trying to work out the best method for rolling our Indexer stack in AWS.

We have recently migrated to Smartstore and 1 week after migration had a number of indexers autoheal which resulted in corrupted buckets all over the place.

Our current thought is to put indexers into manual detention mode prior to the stack roll, but not sure if this forces a bucket roll and replication to S3 or if there is another step required to force this action.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
Buckets are not rolled by putting an indexer into manual detention.
It sounds like auto healing is not a good idea for indexers.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
Buckets are not rolled by putting an indexer into manual detention.
It sounds like auto healing is not a good idea for indexers.
---
If this reply helps you, Karma would be appreciated.

kozanic_mg
Explorer

Thanks Rich - exactly the answer I was after.

Agreed on the autoheal, unfortunately for our situation we don't have any choice so will need to look into how best we can manage the process.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

here is describing how to roll hot buckets of index X to warm: https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Backupindexeddata#Rolling_buckets_manuall...

r. Ismo

kozanic_mg
Explorer

thanks @isoutamo ,

Do you know whether we can use a wildcard option with is command?

IE: 

splunk _internal call /data/indexes/*/roll-hot-buckets

I have been advised that this should work, but we are currently having issues with our non prod environment and so haven't been able to test to confirm. 

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...