topic Re: What volume(s) is indexerWeightByDiskCapacity based on? in Deployment Architecture

What volume(s) is indexerWeightByDiskCapacity based on?

Lucas_K — Tue, 29 Sep 2020 11:11:28 GMT

Is it hot/warm, cold or both combined?

We have a situation where we may have new machines with significantly less hot/warm yet larger cold volume compared to the existing machines.

example.
new indexers - 1tb hot/warm. 40tb cold
old indexers- 2tb hot/warm. 30tb cold

In this situation we'd want a 2:1 ratio occurring between old and new.

If it is based on hot/warm size then it will work without any advertised_disk_capacity fiddling. Old indexers would be twice as likely to be selected.

If it is based on a combination. Then the new boxes would be almost 30% more likely to be selected. Not the situation we want as we'd be rolling to cold faster on these particular machines.

Re: What volume(s) is indexerWeightByDiskCapacity based on?

esix_splunk — Tue, 29 Sep 2020 11:12:30 GMT

This is based on hot/warm volume total disk space and not the cold/frozen volume.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Indexer/indexerdiscovery#Use_weighted_load_balancing

You can also adjust the advertised_disk_capacity setting and move this towards your new servers in order to give them preferential treatment.

Re: What volume(s) is indexerWeightByDiskCapacity based on?

Lucas_K — Mon, 03 Oct 2016 13:03:40 GMT

Not that I don't believe you but that isn't publicly documented anywhere so is that from an internal splunk/dev reference? I was going to get one of our team to log a support ticket to find out.

I know I can adjust it with the advertised option but I just needed to know what disks I should be using so that we don't get caught out 🙂

We have some new boxes that will leave us quite exposed in terms of space.

Re: What volume(s) is indexerWeightByDiskCapacity based on?

lukejadamec — Tue, 29 Sep 2020 11:12:36 GMT

I don't have a system to test this, but from the load balancing admin doc, it says "The overall traffic sent to each indexer is based this ratio:
indexer_disk_capacity/total_disk_capacity_of_indexers_combined"

If this is math being done by Splunk, then somewhere in the internal logs you should be able to find the values of these parameters, and the result.
The value of "indexer_disk_capacity" should answer your question. If you can find it.

Re: What volume(s) is indexerWeightByDiskCapacity based on?

Lucas_K — Mon, 03 Oct 2016 22:50:20 GMT

I now have confirmation from the documentation staff that it is actually calculated on hot/warm volume as you said 🙂