ah ! Can you try to run the below HDFS balancer command , The below command would move the blocks at a decent pace and would not affect the existing jobs nohup hdfs balancer -Ddfs.balancer.moverThreads=5000 -Ddfs.datanode.balance.max.concurrent.moves=20 -Ddfs.datanode.balance.bandwidthPerSec=10737418240 -Ddfs.balancer.dispatcherThreads=200 -Ddfs.balancer.max-size-to-move=100737418240 -threshold 10 1>/home/hdfs/balancer/balancer-out_$(date +"%Y%m%d%H%M%S").log 2>/home/hdfs/balancer/balancer-err_$(date +"%Y%m%d%H%M%S").log   you can also refer to the below doc if you need any tuning https://docs.cloudera.com/HDPDocuments/HDP3/HDP-3.1.5/data-storage/content/balancer_commands.html ... View more

Hello @clouderaskme ,   From the above error message , we could tell that you would be hitting  SOLR-3504. The issue is due to limitation from Solr side where 1 shard can only index upto 2.14 Billion. The solution would be to create a new ranger_audits collection with 2 shards instead of 1. As it can index more documents.   You may also try to delete the older records if the solr instance is still up and running and see if the issue been resolved. Please modify the http with https if SSL is enabled and check the port as per your environment and run the below command. curl -ikv --negotiate -u: "http://$(hostname -f):8886/solr/ranger_audits/update?commit=true" -H "Content-Type: text/xml" --data-binary "<delete><query>evtTime:[* TO NOW-15DAYS]</query></delete>"   There is another method of splitting the shard. Please refer to the below doc https://my.cloudera.com/knowledge/ERROR-quotToo-many-documents-composite-IndexReaders-cannot?id=74738 ... View more