Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Download manual as PDF

Download topic as PDF

Determine which indexes.conf changes require restart

Some changes to indexes.conf require that you restart the indexer for the changes to take effect:

  • Changing any of these attributes: rawChunkSizeBytes, minRawFileSyncSecs, syncMeta, maxConcurrentOptimizes, coldToFrozenDir, coldtoFrozenScript
  • Changing any of these attributes for existing indexes: repFactor, homePath, coldPath, thawedPath, bloomHomePath, summaryHomePath, tstatsHomePath, remotePath, datatype
  • Adding or removing a volume
  • Enabling or disabling an index that contains data
  • Removing an index

You do not need to restart the indexer if you only make these changes:

  • Adding new index stanzas.
  • Changing any attributes not listed as requiring restart
  • Enabling or disabling an index that contains no data

The configuration changes that cause the peer nodes in an indexer cluster to undergo a rolling restart are a superset of those listed here. See Restart or reload after configuration bundle changes?

Note: For information on other configuration changes, outside of indexes.conf, that require a restart, see When to restart Splunk Enterprise after a configuration file change in the Admin Manual.

Reduce tsidx disk usage
Use the monitoring console to view index and volume status

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 8.0.0, 8.0.1, 8.0.2


Dvg06 - RemotePath does require a restart. The doc has been updated.

Sgoodman, Splunker
January 27, 2020

Does remotePath change require a restart?

January 12, 2020

Ilyaresh - Thanks for reporting that error in the docs. I've updated the page.

Sgoodman, Splunker
September 20, 2019

I've tried changing frozenTimePeriodInSecs on existing index with and without data and it didn't require restart to push the bundle, and the bundle was pushed successfully (and the retention period was applied), can you please verify.
ILYA Reshetnikov

August 29, 2019

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters