Determine which indexes.conf changes require restart

Some changes to indexes.conf require that you restart the indexer for the changes to take effect:

• Changing any of these attributes: rawChunkSizeBytes, minRawFileSyncSecs, syncMeta, maxConcurrentOptimizes, coldToFrozenDir, coldtoFrozenScript, memPoolMB, maxRunningProcessGroups, maxVolumeDataSizeMB
• Changing any of these attributes for existing indexes: repFactor, homePath, coldPath, thawedPath, bloomHomePath, summaryHomePath, tstatsHomePath, remotePath, coldPath.maxDataSizeMB, datatype
• Adding or removing a volume
• Enabling or disabling an index that contains data

You do not need to restart the indexer when you make these changes:

• Adding new index stanzas.
• Removing an index on a non-clustered indexer. Note that removing an index on a clustered indexer, which requires directly editing indexes.conf, does require a restart. For more information on removing both non-clustered and clustered indexes, see Remove an index entirely.
• Changing any attributes not listed as requiring restart.
• Enabling or disabling an index that contains no data.

The configuration changes that cause the peer nodes in an indexer cluster to undergo a rolling restart are a superset of those listed here. See Restart or reload after configuration bundle changes?

Note: For information on other configuration changes, outside of indexes.conf, that require a restart, see When to restart Splunk Enterprise after a configuration file change in the Admin Manual.