Determine which indexes.conf changes require restart
Some changes to indexes.conf
require that you restart the indexer for the changes to take effect:
- Changing any of these attributes:
rawChunkSizeBytes
,minRawFileSyncSecs
,syncMeta
,maxConcurrentOptimizes
,coldToFrozenDir
,coldtoFrozenScript, memPoolMB
,maxRunningProcessGroups
,maxVolumeDataSizeMB
- Changing any of these attributes for existing indexes:
repFactor
,homePath
,coldPath
,thawedPath
,bloomHomePath
,summaryHomePath
,tstatsHomePath
,remotePath
,coldPath.maxDataSizeMB
,datatype
- Adding or removing a volume
- Enabling or disabling an index that contains data
You do not need to restart the indexer when you make these changes:
- Adding new index stanzas.
- Removing an index on a non-clustered indexer. Note that removing an index on a clustered indexer, which requires directly editing indexes.conf, does require a restart. For more information on removing both non-clustered and clustered indexes, see Remove an index entirely.
- Changing any attributes not listed as requiring restart.
- Enabling or disabling an index that contains no data.
The configuration changes that cause the peer nodes in an indexer cluster to undergo a rolling restart are a superset of those listed here. See Restart or reload after configuration bundle changes?
Note: For information on other configuration changes, outside of indexes.conf
, that require a restart, see When to restart Splunk Enterprise after a configuration file change in the Admin Manual.