topic Re: Data Rebalancing vs Roll or Resync - What is best to do for "Search Factor is Not Met" and "Replicati in Splunk Enterprise

Data Rebalancing vs Roll or Resync - What is best to do for "Search Factor is Not Met" and "Replication Factor is Not M"

robertlynch2020 — Mon, 22 May 2023 11:03:54 GMT

We are getting the following error message, I think I have a few options, but I am not sure what is the best.

I have read this but still not sure what to do.

https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Anomalousbuckets

What are the pros and cons of each option?

Or do I run a data rebalancing? On one Index, in this case, its a small index, so I should finish quickly...

@pravin

Re: Data Rebalancing vs Roll or Resync - What is best to do for "Search Factor is Not Met" and "Replicati

tej57 — Tue, 23 May 2023 03:58:56 GMT

Hey @robertlynch2020 ,

Both options are completely different for their use case. If SF/RF are not met, you should first identify the reason for not being met, and based on the reason you can decide if the roll/resync of bucket operation will help you achieve the cluster stability or not.

On the other hand, data rebalance is something that you would perform when the bucket distribution between the peers is uneven on a larger scale. For an instance, consider an indexer cluster of 3 peers with bucket distribution of 100, 150, and 1000 buckets on each peer. In this case, you would want to perform the data rebalance activity.

---

If the above answer helps, Karma is appreciated..!! 🙂

Re: Data Rebalancing vs Roll or Resync - What is best to do for "Search Factor is Not Met" and "Replicati

robertlynch2020 — Tue, 23 May 2023 14:42:53 GMT

Thanks for the replay.

How do I find the reason for this happening?

Re: Data Rebalancing vs Roll or Resync - What is best to do for "Search Factor is Not Met" and "Replicati

tej57 — Wed, 24 May 2023 07:05:54 GMT

Restart could be responsible for this message. You can try resyncing the bucket and it should resolve the issue without downtime.

Re: Data Rebalancing vs Roll or Resync - What is best to do for "Search Factor is Not Met" and "Replicati

isoutamo — Wed, 24 May 2023 08:25:29 GMT

maybe this query https://community.splunk.com/t5/Getting-Data-In/How-to-get-list-of-buckets-which-are-having-issues-in/m-p/552731/highlight/true#M91673 help you to found real reason?

Common reason for that fixup task is that bucket hasn't rolled yet to warm, but if I recall right then the message was different? But as @tej57 said you could try to rolling restart for your cluster or just use REST call to roll hot to warm this individual bucket.

Anyhow looking that bucket from _internal index you should found the real reason why it give that error message to you.

r. Ismo

Re: Data Rebalancing vs Roll or Resync - What is best to do for "Search Factor is Not Met" and "Replicati

robertlynch2020 — Fri, 26 May 2023 08:30:28 GMT

Thanks for your help i will look into this one