Hi all,
We have in our productive splunk architecture a very unpleasant problem.
The rolling-restart behaves not as he should. Be it creating an index or otherwise. In a rolling-restart, every indexer in the index cluster started new without waiting until an indexer again is up. This means that our index cluster each time is completely down! Why splunk not wait and restarts one indexer after another? What is the time splunk waits until he restarts another indexer?
After a restart every indexer have about one hour till he is index ready and searchable. This why every indexer has one hour to work off his buckets. For this reason we are each time a whole hour offline.
Details about our environment:
- 8 node index cluster (2 sites)
- replication factor is 3
- search factor is 2
- indexes 143
- all configuration is held on the master and pushed to the peers
- search head cluster consisting of 7 members
I'm grateful for any help.
Regards,
Yanick
↧