Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Determine which indexes.conf changes require restart

Some changes to indexes.conf require that you restart the indexer for the changes to take effect:

  • Changing any of these attributes: rawChunkSizeBytes, minRawFileSyncSecs, syncMeta, maxConcurrentOptimizes, coldToFrozenDir, coldtoFrozenScript, memPoolMB
  • Changing any of these attributes for existing indexes: repFactor, homePath, coldPath, thawedPath, bloomHomePath, summaryHomePath, tstatsHomePath, remotePath, coldPath.maxDataSizeMB, datatype
  • Adding or removing a volume
  • Enabling or disabling an index that contains data

You do not need to restart the indexer if you only make these changes:

  • Adding new index stanzas.
  • Removing an index
  • Changing any attributes not listed as requiring restart
  • Enabling or disabling an index that contains no data

The configuration changes that cause the peer nodes in an indexer cluster to undergo a rolling restart are a superset of those listed here. See Restart or reload after configuration bundle changes?

Note: For information on other configuration changes, outside of indexes.conf, that require a restart, see When to restart Splunk Enterprise after a configuration file change in the Admin Manual.

Last modified on 31 January, 2022
Reduce tsidx disk usage
Use the monitoring console to view index and volume status

This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.2.0, 9.2.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters