Having to restart index cluster

[johannamayer]

Hi Splunkers, I am experiencing issues with an index cluster and it would be great if you could help me out.

Every time I change or create an index a restart is required and it takes up to an hour until all the indexers are ready again. This used to work without a restart and only started happening after an upgrade at some point. I found this, but that doesn't say anything about creating indexes.

Do you have an idea where this is coming from exactly and if it can be avoided in some way? Since changes are made weekly, it is really annoying.

[gcusello]

Hi @johannamayer,

Index creation isn't an activity that usually is frequently performed and usually should be planned and executed when there something relevant change (e.g. new sources or new requirements).

If you frequently (also weekly creation is a strange fequency!) need to create new indexes probably there a wrong interpretation of the index concept:

an index is a container where logs are stored, you can create indexes for each technology you ingest but you can also put different technologies in the same index, the aspect to consider in index definition are:

• retention,
• access grants.

in other words, you have to put in the same index logs with the same retention period and the same access grants, if you have logs with different repetion periods or different access grants, you have to put them in different indexes, in other words indexes aren't database tables, they are conteiners, the log definition is done with the sourcetype and there is no sense to create e.g. an index for the same logs with the week definition in the name.

Anyway, answering to your question, you can also delay your rolling restart but until the restart is completed the new indexes aren't obviously available!

Ciao.

Giuseppe