Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Determine which indexes.conf changes require restart

Some changes to indexes.conf require that you restart the indexer for the changes to take effect:

  • Changing any of these attributes: rawChunkSizeBytes, minRawFileSyncSecs, syncMeta, maxConcurrentOptimizes, coldToFrozenDir, coldtoFrozenScript, memPoolMB, maxRunningProcessGroups, maxVolumeDataSizeMB
  • Changing any of these attributes for existing indexes: repFactor, homePath, coldPath, thawedPath, bloomHomePath, summaryHomePath, tstatsHomePath, remotePath, coldPath.maxDataSizeMB, datatype
  • Adding or removing a volume
  • Enabling or disabling an index that contains data

You do not need to restart the indexer if you only make these changes:

  • Adding new index stanzas.
  • Removing an index
  • Changing any attributes not listed as requiring restart
  • Enabling or disabling an index that contains no data

The configuration changes that cause the peer nodes in an indexer cluster to undergo a rolling restart are a superset of those listed here. See Restart or reload after configuration bundle changes?

Note: For information on other configuration changes, outside of indexes.conf, that require a restart, see When to restart Splunk Enterprise after a configuration file change in the Admin Manual.

Last modified on 14 May, 2024
Reduce tsidx disk usage   Use the monitoring console to view index and volume status

This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.2.0, 9.2.1

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters