Hi
We're using a search head, two indexers (not clustered) as search peers and deployment server to deploy apps to all this roles and all forwarders. For clustered indexers, there's the option to perform a rolling restart in order to keep it available at all times.
For non-clustered indexers, there seems to be no such option. How can I make sure one indexer is always available when an app pulled from the DS is restarting splunk?
It's clear that this doesn't make sense since only half the data would be available with only one indexer availeble. It's also clear that forwarders will queue up while no indexer is available, so it's not a real problem. Still I'm wondering how to make sure that indexers are restarted in a rolling fashion. Maybe through different quiesce timeouts?
Thank you in advance.
... View more