Configure a dedicated server for all data replication

[Nawab]

while configuring RF and SH, can we configure that only one server should be used for saving all copies of data and does not participate in indexing, only participate in searching when needed.

[gcusello]

Hi @Nawab,

no it isn't possible: in Splunk data are replicated between all the indexers (based on Replication Factor and Search Factor) and all the Indexers partecipate to searches.

You can choose the number of copies of replicated raw data (Replication Factor) that use around 15% or the original data and the number of copies of idxs (Replication Factor) that use around 35% or the original data.

For more infos see at https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Aboutclusters.

Ciao.

Giuseppe