Hi @johannamayer, Index creation isn't an activity that usually is frequently performed and usually should be planned and executed when there something relevant change (e.g. new sources or new requirements). If you frequently (also weekly creation is a strange fequency!) need to create new indexes probably there a wrong interpretation of the index concept: an index is a container where logs are stored, you can create indexes for each technology you ingest but you can also put different technologies in the same index, the aspect to consider in index definition are: retention, access grants. in other words, you have to put in the same index logs with the same retention period and the same access grants, if you have logs with different repetion periods or different access grants, you have to put them in different indexes, in other words indexes aren't database tables, they are conteiners, the log definition is done with the sourcetype and there is no sense to create e.g. an index for the same logs with the week definition in the name. Anyway, answering to your question, you can also delay your rolling restart but until the restart is completed the new indexes aren't obviously available! Ciao. Giuseppe
... View more
