Good morning fellow Splunkers, I am wondering what the caller=init_roll is and if someone could point me to some documentation about it, as I haven't found any yet. Basically, I changed the maxDataSize in indexes.conf to 'auto_high_volume' (10GB) from the default of 750MB, and I assume I see all of the current hot buckets for that index rolling to warm so Splunk can start filling the new hot buckets that have the new, increased data size cap. However, I haven't been able to find any documentation via google about the 'caller=init_roll' so I can confirm my educated guess. ... View more

Hi everyone, We are having trouble with index cluster stability and I was given these configuration changes to make to our Index Cluster.  However, I am troubled because these are A LOT of changes. The person who suggested this was offering these configurations because they said as your Splunk deployment grows it must be tuned (and that is logical enough) but I am still troubled by the sheer number of suggested configuration changes. We have three indexers in our cluster. I wanted to throw these configurations out there as fodder and see what youguys come back with.  Thanks! In server.conf on each indexer: [clustering] cxn_timeout = 300 send_timeout = 300 rcv_timeout = 300 heartbeat_period = 10   [httpServer] busyKeepAliveIdleTimeout = 180 streamInWriteTimeout = 30   [sslConfig] useClientSSLCompression = False   In server.conf on the Cluster Master: [clustering] executor_workers = 16 heartbeat_timeout = 300 cxn_timeout = 300 send_timeout = 300 rcv_timeout = 300 max_peer_build_load = 5 max_fixup_time_ms = 5000 max_peers_to_download_bundle = 5   [httpServer] busyKeepAliveIdleTimeout = 180 streamInWriteTimeout = 30   [sslConfig] useClientSSLCompression = false   In distsearch.conf on indexers and cluster master: [replicationSettings] sendRcvTimeout = 120   In distsearch.conf on all search heads: statusTimeout = 120 connectionTimeout =120 authTokenConnectionTimeout = 120 authTokenSendTimeout = 120 authTokenReceiveTimeout = 120 #receiveTimeout = 120   [replicationSettings] connectionTimeout =120 sendRcvTimeout = 120   in server.conf on the search heads: [sslConfig] useClientSSLCompression = false   See what I mean? That's a lot of changes! So many that it makes surprised and a little uncomfortable. If anybody has any specific experiences with these settings please let me know. Thanks! -TJ ... View more