Increasing Replication and Search Factor

shrutheen — Tue, 11 Oct 2022 08:31:52 GMT

I have 3 Search Heads and 3 Indexers with Replication Factor =1 and Search Factor=1. My requirement is to increase this to RF=3 and SF=2

Each indexer has around 800GB of data.

Now if I increase the replication factor to 3 does it mean each indexer will end up with around 2.4TB of data post data rebalancing.

And what would be the approximate data size in each indexer if RF is set to 2.

Re: Increasing Replication and Search Factor

gcusello — Tue, 11 Oct 2022 09:34:36 GMT

Hi @shrutheen,

The question is: I suppose that you have an Indexer Cluster, so why have you RF=1?

Anyway, I think that having 800 GB with RF=1 and SF=1 you shouldn't have 2400 GB with RF=3 and SR=2 because the tsindexes (SF) take around the 35% of the space required, so you should have for 100GB/day:

total row data = 100GB * 15% * RF = 45GB tsindexes data = 100GB * 35% * SF = 70GB total storage = 115GB peer storage =total / 3 = 38.3GB

So what's the daily indexed logs of your infrastructure?

For this job is usually requested at least a Splunk Architect, this isn't a job for the Community.

Ciao.

Giuseppe

topic Increasing Replication and Search Factor in Deployment Architecture

Increasing Replication and Search Factor

Re: Increasing Replication and Search Factor