https://community.splunk.com/t5/Getting-Data-In/Share-index-by-NFS-to-multiple-searchers/m-p/299527#M56662 <P>Hello.<BR /> I explain the scenario:<BR /> I have 2 servers destined to different functions ServerA (receive and index, few searches) and ServerB (full searches)<BR /> In particular, the ServerB will be the database with /dbsplunk partition with 3TB.<BR /> While the ServerA, it will receive the data and index it on the NFS /dbsplunk mounted drive from the ServerB.</P> <P>So far, the indexing works very well, the data is stored without problems. But when doing searches, both can search the buckets WARM or COLD, but bucket HOT can not be searched. I understand because Splunk blocks the HOT at the time of writing, but I know that Splunk can replicate the HOT files so that other searchers can access the search (1 for each search), according to the following link: <A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/Indexer/HowSplunkstoresindexes#Bucket_names">http://docs.splunk.com/Documentation/Splunk/6.6.0/Indexer/HowSplunkstoresindexes#Bucket_names</A></P> <P>How could I get the ServerA and ServerB to search in bucket HOT at the same time. I know that in the indexes.conf file there is the parameter repFactor = auto, but I do not know how to get it.</P> Fri, 06 Oct 2017 14:48:41 GMT jrodriguezap 2017-10-06T14:48:41Z https://community.splunk.com/t5/Getting-Data-In/Share-index-by-NFS-to-multiple-searchers/m-p/299527#M56662 <P>Hello.<BR /> I explain the scenario:<BR /> I have 2 servers destined to different functions ServerA (receive and index, few searches) and ServerB (full searches)<BR /> In particular, the ServerB will be the database with /dbsplunk partition with 3TB.<BR /> While the ServerA, it will receive the data and index it on the NFS /dbsplunk mounted drive from the ServerB.</P> <P>So far, the indexing works very well, the data is stored without problems. But when doing searches, both can search the buckets WARM or COLD, but bucket HOT can not be searched. I understand because Splunk blocks the HOT at the time of writing, but I know that Splunk can replicate the HOT files so that other searchers can access the search (1 for each search), according to the following link: <A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/Indexer/HowSplunkstoresindexes#Bucket_names">http://docs.splunk.com/Documentation/Splunk/6.6.0/Indexer/HowSplunkstoresindexes#Bucket_names</A></P> <P>How could I get the ServerA and ServerB to search in bucket HOT at the same time. I know that in the indexes.conf file there is the parameter repFactor = auto, but I do not know how to get it.</P> Fri, 06 Oct 2017 14:48:41 GMT https://community.splunk.com/t5/Getting-Data-In/Share-index-by-NFS-to-multiple-searchers/m-p/299527#M56662 jrodriguezap 2017-10-06T14:48:41Z https://community.splunk.com/t5/Getting-Data-In/Share-index-by-NFS-to-multiple-searchers/m-p/299528#M56663 <P>will there be someone who has happened to him?</P> Mon, 09 Oct 2017 15:16:11 GMT https://community.splunk.com/t5/Getting-Data-In/Share-index-by-NFS-to-multiple-searchers/m-p/299528#M56663 jrodriguezap 2017-10-09T15:16:11Z https://community.splunk.com/t5/Getting-Data-In/Share-index-by-NFS-to-multiple-searchers/m-p/299529#M56664 <P>Splunk does not handle that situation, as each indexer will try to manage the buckets, and generate conflicts.</P> <P>Why not use the indexes replication cluster feature to have the indexes you want replicated on the 2 indexers (with replication and search factor 2) ?</P> Mon, 09 Oct 2017 17:43:51 GMT https://community.splunk.com/t5/Getting-Data-In/Share-index-by-NFS-to-multiple-searchers/m-p/299529#M56664 yannK 2017-10-09T17:43:51Z