Archive

Replication and search factors "not met"

Explorer

We have:
- Index Cluster Master
- Search head cluster (3 nodes)
- Index Cluster (3 nodes)
- Heavy forwarder (1 node)
- Configuration manager
- API collector

None have a repFactor setting in /opt/splunk/etc/system/local/indexes.conf. All have "repFactor = 0" in /opt/splunk/etc/system/default/indexes.conf.

"search_factor = 2" is set in all the default server.conf files and is set on the Index Cluster Master in /opt/splunk/etc/system/local/server.conf - "search_factor = 2"

"replication_factor = 3" is set in all the default server.conf files and is set to "replication_factor = 2" on the 3 search head clusters Index Cluster Master in /opt/splunk/etc/system/local/server.conf - "search_factor = 2"

Running "bin/splunk show cluster-status --verbose" produces:

Replication factor not met
Search factor not met

We are looking to upgrade from 6.5.3 to 7.2.4. Does any of the above need a resolution before attempting the upgrade?

Does the "not met" indicate that index replication if not functioning correctly?

Please advise.

Regards, David.

Tags (1)
0 Karma

Explorer

please put replication factor greater than search factor. Post that you should not see the same error anymore.

0 Karma

Explorer

I set
replication_factor = 3
in all the places that it had been set to 2, then restarted every node in the enterprise cluster.
But re-running "bin/splunk show cluster-status --verbose" still produces:

Replication factor not met
Search factor not met

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!