config changes indexes.conf - restart query

[goelt2000]

Hi All,

Do we need an indexer restart in non clustered search peers for these changes?

Is reloading not enough?

 https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Determinerestart

in particular "coldPath.maxDataSizeMB" and "Enabling or disabling an index that contains data"

I don't think Splunk throws any errors or blocks subsequent indexes.conf changes when this happens. I need to check the logs, when any change is made in coldPath.maxDataSizeMB. But I am sure when disabling an index, the things go smooth without a restart. Why do we need a restart then?

Thanks!

[codebuilder]

If you push out a new index then a restart/rolling restart of the indexers is not necessary.

If you make any changes to indexes.conf (other than a new index) the a restart is required (rolling restart for indexer cluster).

For an indexer cluster you need to use the master for bundle verification and push.

[goelt2000]

Thanks for the reply. the indexes.conf documentation does not say to restart it though when we disable.

Am I missing something?

https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Indexesconf

Thanks!

[codebuilder]

Disabling an index does not require a restart, along with creating a new one (as I mentioned). Those are the two exceptions. Any other parameter changes require restart. The master will let you know if rolling restart is required after bundle validation.