I am still going through this for a conclusive answer, Splunk KB has limited information. I have noticed that we could run this rebalance indexer by indexer -action -indexer (path) . You could also initiate the same via the UI in the Cluster Master console, >> Indexing Cluster - master node, Edit info, Data rebalance and select indexer by indexer. This is way faster than the CLI rebalance command. ... View more