Determine which indexes.conf changes require restart
Some changes to
indexes.conf require that you restart the indexer for the changes to take effect:
- Changing any of these attributes:
rawChunkSizeBytes, minRawFileSyncSecs, syncMeta, maxConcurrentOptimizes, coldToFrozenDir, coldtoFrozenScript, memPoolMB
- Changing any of these attributes for existing indexes:
repFactor, homePath, coldPath, thawedPath, bloomHomePath, summaryHomePath, tstatsHomePath, remotePath, coldPath.maxDataSizeMB, datatype
- Adding or removing a volume
- Enabling or disabling an index that contains data
You do not need to restart the indexer if you only make these changes:
- Adding new index stanzas.
- Removing an index
- Changing any attributes not listed as requiring restart
- Enabling or disabling an index that contains no data
The configuration changes that cause the peer nodes in an indexer cluster to undergo a rolling restart are a superset of those listed here. See Restart or reload after configuration bundle changes?
Note: For information on other configuration changes, outside of
indexes.conf, that require a restart, see When to restart Splunk Enterprise after a configuration file change in the Admin Manual.
Reduce tsidx disk usage
Use the monitoring console to view index and volume status
This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.1.0, 9.1.1