Cold bucket rolling with indexers in Maintenance Mode

[nicofantinato]

Hi all,

I have a cluster with 2 indexers, plus a cluster master in a different server. For some reasons that I don't know (since we've inherited the environment), the two indexers store hot/warm buckets locally and cold buckets in a NAS (same NAS for both indexers).

We have to perform an activity on that NAS, so that it will be unavailable for a period of 3-4 hours. 

My question is, putting the indexers in maintenance mode do I stop cold buckets from being generated? Or do you have any suggestion to perform this activity avoiding any data loss? Sorry but from Splunk documentation I can't find sure informations about this activity on both indexers at the same time.

Thanks in advance.

[isoutamo]

Hi

Even you put CM to maintenance mode, splunk could index new event into it. This also means that it can move warm buckets to cold. With shortly thinking your situation I cannot figure out how you could easily stop that warm -> cold movement without stopping splunk on those nodes.

Btw. NAS is not recommended storage for cold buckets, it should only use for frozen. 

r. Ismo