Search Factor is not met

jlroberts — Fri, 03 Apr 2015 14:10:26 GMT

Greetings!

We are using S.O.S. to debug our cluster. Right now in SOS, on the cluster master view, it is showing

Replication Factor: 3
Search Factor: 1

However, on our Cluster Master, we have set

Replication Factor: 2
Search Factor: 2

Here is the output from ./splunk list cluster-peers

    24002090-5EDB-44D6-B99D-E95C3FF27BFD
            active_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
            base_generation_id:205
            bucket_count:5370
            delayed_buckets_to_discard:
            fixup_set:
            heartbeat_started:1
            host_port_pair:172.22.77.162:8089
            is_searchable:1
            label:ii-splunk-peer1
            last_heartbeat:1428069707
            latest_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
            pending_job_count:0
            primary_count:3167
            primary_count_remote:0
            replication_count:0
            replication_port:9887
            replication_use_ssl:0
            site:default
            status:Up

    3E8F7683-A2C7-4C79-A1B2-B8765E7325E6
            active_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
            base_generation_id:210
            bucket_count:4753
            delayed_buckets_to_discard:
            fixup_set:
            heartbeat_started:1
            host_port_pair:172.22.77.164:8089
            is_searchable:1
            label:ii-splunk-peer3
            last_heartbeat:1428069707
            latest_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
            pending_job_count:0
            primary_count:87
            primary_count_remote:0
            replication_count:0
            replication_port:9887
            replication_use_ssl:0
            site:default
            status:Up

    58478145-DA96-4B4E-8C2E-69429BD38BDB
            active_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
            base_generation_id:207
            bucket_count:4888
            delayed_buckets_to_discard:
            fixup_set:
            heartbeat_started:1
            host_port_pair:172.22.77.163:8089
            is_searchable:1
            label:ii-splunk-peer2
            last_heartbeat:1428069707
            latest_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
            pending_job_count:0
            primary_count:3159
            primary_count_remote:0
            replication_count:0
            replication_port:9887
            replication_use_ssl:0
            site:default
            status:Up

    F31ECF68-62CA-4639-9CD2-5F00465BD4C9
            active_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
            base_generation_id:204
            bucket_count:4759
            delayed_buckets_to_discard:
            fixup_set:
            heartbeat_started:1
            host_port_pair:172.22.77.165:8089
            is_searchable:1
            label:ii-splunk-peer4
            last_heartbeat:1428069707
            latest_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
            pending_job_count:0
            primary_count:3174
            primary_count_remote:0
            replication_count:0
            replication_port:9887
            replication_use_ssl:0
            site:default
            status:Up

Here is the output from ./splunk list search-server

Server at URI "172.22.77.162:8089" with status as "Up"
Server at URI "172.22.77.163:8089" with status as "Up"
Server at URI "172.22.77.164:8089" with status as "Up"
Server at URI "172.22.77.165:8089" with status as "Up"

Any ideas on why the Search factor is not met or how I can further troubleshoot why the Search factor is not met would be greatly appreciated.

Thank you

Jeffrey

Re: Search Factor is not met

NOUMSSI — Fri, 03 Apr 2015 14:36:49 GMT

Hi,

How many members have you in your cluster?
Firstly, the value of Replication Factor must be lower or equal to the number of your cluster members
secondly, make sure that the values of attributes (Replication Factor and Search Factor) in SOS app are less than attributes (Replication Factor and Search Factor) in your deployment

Re: Search Factor is not met

dxu_splunk — Fri, 03 Apr 2015 21:44:20 GMT

i'd start with looking at which buckets are not meeting SF, and their states.

go to the cluster master buckets endpoint:

https://master-uri:mgmt-port/services/cluster/master/buckets?filter=search_count<2&filter=frozen=false

if nothing shows up there, check out

https://master-uri:mgmt-port/services/cluster/master/buckets?filter=search_state=PendingSearchable

to see if any buckets are currently being made searchable (so as to meet SF)

topic Search Factor is not met in Deployment Architecture

Search Factor is not met

Re: Search Factor is not met

Re: Search Factor is not met