Does putting indexer into manual detention roll active hot buckets?

[kozanic_mg]

Hi All,

We are trying to work out the best method for rolling our Indexer stack in AWS.

We have recently migrated to Smartstore and 1 week after migration had a number of indexers autoheal which resulted in corrupted buckets all over the place.

Our current thought is to put indexers into manual detention mode prior to the stack roll, but not sure if this forces a bucket roll and replication to S3 or if there is another step required to force this action.

[richgalloway · Accepted solution]

Buckets are not rolled by putting an indexer into manual detention.
It sounds like auto healing is not a good idea for indexers.

[kozanic_mg]

Thanks Rich - exactly the answer I was after.

Agreed on the autoheal, unfortunately for our situation we don't have any choice so will need to look into how best we can manage the process.

[isoutamo]

Hi

here is describing how to roll hot buckets of index X to warm: https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Backupindexeddata#Rolling_buckets_manuall...

r. Ismo

[kozanic_mg]

thanks @isoutamo ,

Do you know whether we can use a wildcard option with is command?

IE: 

splunk _internal call /data/indexes/*/roll-hot-buckets

I have been advised that this should work, but we are currently having issues with our non prod environment and so haven't been able to test to confirm.