Deployment Architecture

Are there any other reasons to have a search factor not equal to replication factor?

fredclown
Builder

If space is not really an issue are there any other reasons to have the search factor lower that the replication factor? Thanks.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @fredclown,

no, the only reason is storage saving because indexes are the most part of storage occupation (row data iare around 15% of the original data and indexes are around 35% or the original data).

if you haven't storage occupation problems, you can use the same SF and RF.

Ciao.

Giuseppe

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

This is really a border case but remember that indexes are built independently on each indexer so if you have SF=RF=8, you use CPU time for indexing on 8 indexers whereas if you have RF=8 but SF=2, you just stream the data to 6 indexers and store it and only on 2 indexers you prepare searchable indexed data for the bucket.

As I said, it's a border case since often the difference across your environment will be insignificant but there is a difference.

Also remember that only primary copy of the bucket participates in search so having a high SF lets you recover from disaster easier but doesn't speed up searches.

gcusello
SplunkTrust
SplunkTrust

Hi @fredclown,

no, the only reason is storage saving because indexes are the most part of storage occupation (row data iare around 15% of the original data and indexes are around 35% or the original data).

if you haven't storage occupation problems, you can use the same SF and RF.

Ciao.

Giuseppe

fredclown
Builder

Thanks sir.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...