Splunk Enterprise

Why isn't a Data Rebalance rebalancing my Primary Buckets?

baarb21
Engager

Hello All, 

 

I currently have 6 indexers. Three of them are being forwarded data from outside sources. And the other three were added much later. I have a SF 1 and RF 1 (I understand this is not optimal, but due to space constraints that was the best I could do). 

My main question is, why isn't a data rebalance rebalancing primary buckets? Even with a RF of 1, the three new indexers seem to only receive replicated buckets. Which is rather confusing. 

 

I have tried using this: Rebalance the indexer cluster - Splunk Documentation

curl -k -u admin:pass --request POST \
  https://localhost:8089/services/cluster/manager/control/control/rebalance_primaries

Nothing would occur after that. 

 

Labels (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

The primary bucket rebalancing takes place among any existing peers that have searchable bucket copies. Since your newly added indexers do not have any primary bucket on it (based on information that they're not ingesting any data and RF/SF is 1 so buckets are getting replicated to them), nothing happens when you do the rebalance.

baarb21
Engager

Thank you for your response. Why would buckets be replicated to those newly added indexers (ones that are not ingesting data) if we have an RF of 1? 

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...