topic Re: Different number of buckets in Deployment Architecture

Different number of buckets

Dias — Thu, 24 Jun 2021 06:23:00 GMT

Hi, I have an issue in indexer cluster. It's been a month since i noticed there are different number of buckets in two indexers. Search factor, Replication factor fine. What is the reason for this difference?

Re: Different number of buckets

isoutamo — Thu, 24 Jun 2021 06:50:47 GMT

Have you check that those are not excess buckets?
r. Ismo

Re: Different number of buckets

Dias — Thu, 24 Jun 2021 11:42:51 GMT

I checked the bucket status and there are no excess buckets.

Re: Different number of buckets

isoutamo — Tue, 29 Jun 2021 19:51:59 GMT

Are all your indexes replicated over cluster, including internal indexes (repFactor = auto) ?

Re: Different number of buckets

Dias — Wed, 07 Jul 2021 11:26:10 GMT

I checked the indexes and it is "repFactor=auto"everywhere. Do you know where to check for internal indexes repFactor?

Re: Different number of buckets

isoutamo — Mon, 12 Jul 2021 09:48:37 GMT

The easiest way is use the next command on cli.

splunk btool indexes list --debug|egrep '(\[|repFa)'|egrep -A1 '\[_'

It also shows where those values comes (usually .../system/default/indexes.conf unless you have changed those). If you need to change these, then the best option is create separate app for those changes.

r. Ismo

Re: Different number of buckets

Dias — Wed, 14 Jul 2021 03:52:13 GMT

Thanks for the answer, I've checked the internal indexes. And there were those in which repFactor=0. I changed it to repFactor=auto. Your CLI command helped a lot, thanks again.