Different number of buckets

[Dias]

Hi, I have an issue in indexer cluster. It's been a month since i noticed there are different number of buckets in two indexers.  Search factor, Replication factor fine. What is the reason for this difference? 

[isoutamo]

Have you check that those are not excess buckets?
r. Ismo

[Dias]

I checked the bucket status and there are no excess buckets.

[isoutamo]

Are all your indexes replicated over cluster, including internal indexes (repFactor = auto) ?

[Dias]

I checked the indexes and it is "repFactor=auto"everywhere. Do you know where to check for internal indexes repFactor?

[isoutamo · Accepted solution]

The easiest way is use the next command on cli.

splunk btool indexes list --debug|egrep '(\[|repFa)'|egrep -A1 '\[_'

It also shows where those values comes (usually .../system/default/indexes.conf unless you have changed those). If you need to change these, then the best option is create separate app for those changes.

r. Ismo

[Dias]

Thanks for the answer, I've checked the internal indexes. And there were those in which repFactor=0. I changed it to repFactor=auto.  Your CLI command helped a lot, thanks again.