Deployment Architecture

Are there any other reasons to have a search factor not equal to replication factor?

fredclown
Builder

If space is not really an issue are there any other reasons to have the search factor lower that the replication factor? Thanks.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @fredclown,

no, the only reason is storage saving because indexes are the most part of storage occupation (row data iare around 15% of the original data and indexes are around 35% or the original data).

if you haven't storage occupation problems, you can use the same SF and RF.

Ciao.

Giuseppe

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

This is really a border case but remember that indexes are built independently on each indexer so if you have SF=RF=8, you use CPU time for indexing on 8 indexers whereas if you have RF=8 but SF=2, you just stream the data to 6 indexers and store it and only on 2 indexers you prepare searchable indexed data for the bucket.

As I said, it's a border case since often the difference across your environment will be insignificant but there is a difference.

Also remember that only primary copy of the bucket participates in search so having a high SF lets you recover from disaster easier but doesn't speed up searches.

gcusello
SplunkTrust
SplunkTrust

Hi @fredclown,

no, the only reason is storage saving because indexes are the most part of storage occupation (row data iare around 15% of the original data and indexes are around 35% or the original data).

if you haven't storage occupation problems, you can use the same SF and RF.

Ciao.

Giuseppe

fredclown
Builder

Thanks sir.

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...