Help with changing tsidxWritingLevel

splunk_noob2022 — Mon, 26 Dec 2022 18:42:28 GMT

We have a single site indexer cluster with 2 Indexers which are having storage issues so we decided to apply below parameters.

We are currently on Splunk version 8.1.7

1. tsidxWritingLevel = 4

2. enableTsidxReduction = true

3. timePeriodInSecBeforeTsidxReduction = 7890000

The issue here is from cluster Master i can see RF/SF is not met and 1 of the IDX is in Automatic-detention mode, so in this scenario what challenges will i face if above parameters are enabled for all the existing indexes.

Splunk docs doesn't tell much about RF/SF with these parameters.

Re: Help with changing tsidxWritingLevel

DavidHourani — Tue, 27 Dec 2022 04:31:34 GMT

Hi @splunk_noob2022 ,

If an indexer has just gone into detention then most likely the "RF/SF not met" issue is linked to the CM trying to rebuild the buckets lost along with that indexer.

The parameters you posted are simply tuning for the indexes configuration and shouldn't have any effect on RF/SF being met.

Could you please check in your internal logs for the indexer that is in delention to see what other issues could be causing this?

Cheers,

David

topic Help with changing tsidxWritingLevel in Deployment Architecture

Help with changing tsidxWritingLevel

Re: Help with changing tsidxWritingLevel