If one indexer of 6 is about to reach capacity in an indexer cluster. will remaining 5 still index?

[santorof]

One of my indexers is about to reach its storage capacity. I am trying to figure out if/when that happens, will A) all indexers stop indexing or B) will clustering and indexing continue as normal and avoid using indexer 3?

[dxu_splunk · Accepted solution]

The indexer will enter 'detention' state (by default, when there is 5gb left), where it will no longer get any replications / indexing. See http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Howtomonitoracluster#Peers_tab (detention status) and http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Setlimitsondiskusage (minFreeSpace dictates when we go into 'detention')