https://community.splunk.com/t5/Getting-Data-In/Indexer-Menu-7-2-3/m-p/432808#M75680 <P>From Splunk docs:</P> <P>Searchable Data Copies: The number of complete searchable copies of the index that the cluster has.<BR /> Replicated Data Copies: The number of copies of the index that the cluster has. Each copy must be complete, with no buckets missing.</P> <P>It shows that the moment you have one replicated data copy which becomes one searchable data copy, this data is searchable.</P> <P>You can look for more details about the actual number of copies and buckets using this search:</P> <PRE><CODE>| rest splunk_server_group=dmc_group_cluster_master splunk_server_group=dmc_indexerclustergroup* /services/cluster/master/indexes | fields title, is_searchable, replicated_copies_tracker*, searchable_copies_tracker*, num_buckets, index_size | rename replicated_copies_tracker.*.* as rp**, searchable_copies_tracker.*.* as sb** | eval replicated_data_copies = "" | foreach rp*actual_copies_per_slot [eval replicated_data_copies = replicated_data_copies." ".rp&lt;&lt;MATCHSTR&gt;&gt;actual_copies_per_slot."/".rp&lt;&lt;MATCHSTR&gt;&gt;expected_total_per_slot] | makemv replicated_data_copies | eval searchable_data_copies = "" | foreach sb*actual_copies_per_slot [eval searchable_data_copies = searchable_data_copies." ".sb&lt;&lt;MATCHSTR&gt;&gt;actual_copies_per_slot."/".sb&lt;&lt;MATCHSTR&gt;&gt;expected_total_per_slot] | makemv searchable_data_copies | eval is_searchable = if((is_searchable == 1) or (is_searchable == "1"), "Yes", "No") | eval index_size = round(index_size / 1024 / 1024 / 1024, 2)." GB" | fields title, is_searchable, searchable_data_copies, replicated_data_copies, num_buckets, index_size | search title="***" | search is_searchable="*" | rename title as "Index Name", is_searchable as "Fully Searchable", searchable_data_copies as "Searchable Data Copies", replicated_data_copies as "Replicated Data Copies", num_buckets as Buckets, index_size as "Cumulative Raw Data Size" </CODE></PRE> Tue, 06 Aug 2019 12:51:30 GMT Azeemering 2019-08-06T12:51:30Z https://community.splunk.com/t5/Getting-Data-In/Indexer-Menu-7-2-3/m-p/432807#M75679 <P>What is the significance of searchable copies and replicated copies flapping between green and gray on the indexer cluster. Thank you for your assistance. </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7465iE8A278A64C539F61/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 05 Aug 2019 16:45:09 GMT https://community.splunk.com/t5/Getting-Data-In/Indexer-Menu-7-2-3/m-p/432807#M75679 halbeisendv 2019-08-05T16:45:09Z https://community.splunk.com/t5/Getting-Data-In/Indexer-Menu-7-2-3/m-p/432808#M75680 <P>From Splunk docs:</P> <P>Searchable Data Copies: The number of complete searchable copies of the index that the cluster has.<BR /> Replicated Data Copies: The number of copies of the index that the cluster has. Each copy must be complete, with no buckets missing.</P> <P>It shows that the moment you have one replicated data copy which becomes one searchable data copy, this data is searchable.</P> <P>You can look for more details about the actual number of copies and buckets using this search:</P> <PRE><CODE>| rest splunk_server_group=dmc_group_cluster_master splunk_server_group=dmc_indexerclustergroup* /services/cluster/master/indexes | fields title, is_searchable, replicated_copies_tracker*, searchable_copies_tracker*, num_buckets, index_size | rename replicated_copies_tracker.*.* as rp**, searchable_copies_tracker.*.* as sb** | eval replicated_data_copies = "" | foreach rp*actual_copies_per_slot [eval replicated_data_copies = replicated_data_copies." ".rp&lt;&lt;MATCHSTR&gt;&gt;actual_copies_per_slot."/".rp&lt;&lt;MATCHSTR&gt;&gt;expected_total_per_slot] | makemv replicated_data_copies | eval searchable_data_copies = "" | foreach sb*actual_copies_per_slot [eval searchable_data_copies = searchable_data_copies." ".sb&lt;&lt;MATCHSTR&gt;&gt;actual_copies_per_slot."/".sb&lt;&lt;MATCHSTR&gt;&gt;expected_total_per_slot] | makemv searchable_data_copies | eval is_searchable = if((is_searchable == 1) or (is_searchable == "1"), "Yes", "No") | eval index_size = round(index_size / 1024 / 1024 / 1024, 2)." GB" | fields title, is_searchable, searchable_data_copies, replicated_data_copies, num_buckets, index_size | search title="***" | search is_searchable="*" | rename title as "Index Name", is_searchable as "Fully Searchable", searchable_data_copies as "Searchable Data Copies", replicated_data_copies as "Replicated Data Copies", num_buckets as Buckets, index_size as "Cumulative Raw Data Size" </CODE></PRE> Tue, 06 Aug 2019 12:51:30 GMT https://community.splunk.com/t5/Getting-Data-In/Indexer-Menu-7-2-3/m-p/432808#M75680 Azeemering 2019-08-06T12:51:30Z