topic Re: How to reduce the search factor to 2 from 3? in Deployment Architecture

How to reduce the search factor to 2 from 3?

arunsunny — Tue, 20 Oct 2020 14:23:27 GMT

Hello Splunkers,

I have one requirement where have 3 sites and planning to keep the search factor to 2 and replication factor to 3.

Current Config: ( SF=3 and RF=3 )

[clustering]
site_replication_factor = origin:1,site1:1,site2:1,site3:1,total:3
site_search_factor = origin:1,site1:1,site2:1,site3:1,total:3

To making into the Search Factor to 2 in any sites will the below settings works?

[clustering]
site_replication_factor = origin:1,site1:1,site2:1,site3:1,total:3
site_search_factor = origin:1,site1:1,site2:1,site3:1,total:2

To reduce to SF=2 what all steps involved?

Cheers,
Arun Sunny

richgalloway — Tue, 20 Oct 2020 14:47:55 GMT

The proposed site_search_factor setting is invalid. One cannot have a copy on each of three sites and have a total of 2 copies. I suggest

site_search_factor = origin:1,total:2

arunsunny — Tue, 20 Oct 2020 14:56:48 GMT

Thanks for the answer.

So post-change the config only Cluster master required restart?

richgalloway — Tue, 20 Oct 2020 16:42:35 GMT

Yes

arunsunny — Tue, 27 Oct 2020 09:14:42 GMT

One more question:

If we are going to use the below settings:

site_search_factor = origin:1,total:2

Is there a chance of 2 search copy will be there on the same site?

richgalloway — Tue, 27 Oct 2020 13:45:53 GMT

Splunk will put one copy on the original site and the other copy on the other site.