Splunk Search

Cold bucket rolling with indexers in Maintenance Mode

nicofantinato
Path Finder

Hi all,

I have a cluster with 2 indexers, plus a cluster master in a different server. For some reasons that I don't know (since we've inherited the environment), the two indexers store hot/warm buckets locally and cold buckets in a NAS (same NAS for both indexers).

We have to perform an activity on that NAS, so that it will be unavailable for a period of 3-4 hours. 

My question is, putting the indexers in maintenance mode do I stop cold buckets from being generated? Or do you have any suggestion to perform this activity avoiding any data loss? Sorry but from Splunk documentation I can't find sure informations about this activity on both indexers at the same time.

Thanks in advance.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Even you put CM to maintenance mode, splunk could index new event into it. This also means that it can move warm buckets to cold. With shortly thinking your situation I cannot figure out how you could easily stop that warm -> cold movement without stopping splunk on those nodes.

Btw. NAS is not recommended storage for cold buckets, it should only use for frozen. 

r. Ismo

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...