Clarification on SH Cluster replication

[pallabtheartist]

I have setup a SH cluster with 5 node the no replication factor (default 3), i am using a single URL to access the SH with Load balancer. i wanted to know since the replication factor is three so the no of copies of knowledge object would be three , what if some one hit the SH which does not have the copy of knowledge object (dashboard , reports etc) , will the user be able to access those knowledge objects.

[PrewinThomas]

Hi @pallabtheartist ,

The SF and RF is configured on the indexer cluster, which will tell you how many copies of data(buckets) you need to duplicate(RF) and out of that copies how many is searchable(SF).

Knowledge objects created in a search head cluster member replicates to other search head cluster members, which means all the knowledge objects which you have created in a search head will replicate to all the other search head cluster members regardless of your SF and RF settings.

[pallabtheartist]

I was asking about the replication factor in Search head cluster , please see the below Splunk docs

https://docs.splunk.com/Documentation/Splunk/8.0.0/DistSearch/ChooseSHCreplicationfactor