topic Clustered Indexers in Splunk Search

Clustered Indexers

nikhilmehra79 — Tue, 08 Apr 2014 00:25:08 GMT

Hi i have two clustered nodes each getting data from various UF (Load balanced), for simplicity i will take example of one UF. The UF is sending data to both indexers but when i locally log in to each indexers and try to go to search - i see if UF has send 15 events 10 went to first Indexer and 5 went to other.....i was thinking since these are cluster pairs they should have synched and each indexer at end should have received 15 events is this not right?

My env:
1. Master Node
2. 2 Indexers
3. 2 search head
4. Replication Factor 2, Search Factor 2

Re: Clustered Indexers

gfuente — Tue, 08 Apr 2014 10:07:11 GMT

Hello

The data replication happens in the background, when you query (search) the data, you only get it from "active" buckets, so some data will come from one indexer and the rest from the other one. If one of the indexers goes down, then all the buckets in the remaining indexer will become "active" and all the results will come from that indexer.

In the example you propose, if any indexer returns all the data he got (the original and the replicated) you would get duplicated events, distorting the results...

Regards

Re: Clustered Indexers

nikhilmehra79 — Thu, 10 Apr 2014 18:21:49 GMT

So if i understand correctly what you are saying per my example both indexers has 15 events but on First indexer 10 are active (in active bucket) and 5 are passive (hence i do not see them), same goes for indexer B - it has 5 active and 10 passive?

Does this also mean that if i have to see all events i should not be searching them web UI of indexer rather use search head always ??