Archive
Highlighted

Replication and search factors "not met"

Explorer

We have:
- Index Cluster Master
- Search head cluster (3 nodes)
- Index Cluster (3 nodes)
- Heavy forwarder (1 node)
- Configuration manager
- API collector

None have a repFactor setting in /opt/splunk/etc/system/local/indexes.conf. All have "repFactor = 0" in /opt/splunk/etc/system/default/indexes.conf.

"searchfactor = 2" is set in all the default server.conf files and is set on the Index Cluster Master in /opt/splunk/etc/system/local/server.conf - "searchfactor = 2"

"replicationfactor = 3" is set in all the default server.conf files and is set to "replicationfactor = 2" on the 3 search head clusters Index Cluster Master in /opt/splunk/etc/system/local/server.conf - "search_factor = 2"

Running "bin/splunk show cluster-status --verbose" produces:

Replication factor not met
Search factor not met

We are looking to upgrade from 6.5.3 to 7.2.4. Does any of the above need a resolution before attempting the upgrade?

Does the "not met" indicate that index replication if not functioning correctly?

Please advise.

Regards, David.

Tags (1)
0 Karma
Highlighted

Re: Replication and search factors "not met"

Explorer

please put replication factor greater than search factor. Post that you should not see the same error anymore.

0 Karma
Highlighted

Re: Replication and search factors "not met"

Explorer

I set
replication_factor = 3
in all the places that it had been set to 2, then restarted every node in the enterprise cluster.
But re-running "bin/splunk show cluster-status --verbose" still produces:

Replication factor not met
Search factor not met

0 Karma