topic Re: Recommended search/replication factor config for 2 site index cluster w/16 indexers each in Deployment Architecture

Recommended search/replication factor config for 2 site index cluster w/16 indexers each

joesrepsolc — Thu, 17 Jan 2019 16:00:58 GMT

Looking for any performance gains on our architecture and how best to take advantage of the (16) indexer clusters we have in place (1 cluster in CA, and another in midwest)

Today the replication factor = 2, and search factor = 2. Feeling like we can do better and increase performance.

Thoughts? Reasoning?

Thanks!

Re: Recommended search/replication factor config for 2 site index cluster w/16 indexers each

adonio — Thu, 17 Jan 2019 18:56:45 GMT

are those connected? e.g. multi-site cluster or separate indexer clusters?

Re: Recommended search/replication factor config for 2 site index cluster w/16 indexers each

joesrepsolc — Thu, 17 Jan 2019 20:38:50 GMT

It is a multi-site index cluster. (16) indexers at one site and (16) indexers at another site. All managed by a single cluster master.

Re: Recommended search/replication factor config for 2 site index cluster w/16 indexers each

bangalorep — Fri, 18 Jan 2019 04:32:39 GMT

Are you facing any performance issues?
Also, what is the data volume?

Re: Recommended search/replication factor config for 2 site index cluster w/16 indexers each

lakshman239 — Fri, 18 Jan 2019 16:40:48 GMT

Assuming you have multi-site indexer cluster across 2 sites, what's your site search and replication factor? How many copies do you want to store in each site when a new data comes in? Look at your failover and storage considerations.

e.g. any data coming in site 1 can be stored in 2 indexers (or more if you want) in the originating site and another 2 copies in the other site. This will ensure equal amount of data in each site and fault tolerant up-to 2 nodes in a site.

Look at the examples in https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Sitereplicationfactor#Examples and your use cases, available storage to determine/adust Site SF/RF. Generally, distributing the copies equivally in both sites should give you a better performance. Also, if the users are across the world, you may also need to look at balancing them to both sites equally

https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Sitesearchfactor

Re: Recommended search/replication factor config for 2 site index cluster w/16 indexers each

joesrepsolc — Fri, 18 Jan 2019 21:54:30 GMT

no performance problems persay... but something I want to understand better. Obviously looking for as-best of performance as possible out of our system. Doing roughly 4TB/day ingestion.