Does replication happen on hot buckets?

[ddrillic]

The replication subject is a major one in the Splunk 7.1 Cluster Administration class. However, the instructor wasn't clear whether replication happens on hot buckets.

Any thoughts about it?

[adonio · Accepted solution]

yes, replication happens on hot buckets as well, as data coming in.
when it rolls to warm, all buckets, original and replicas are rolling,
see docs here:
http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/HowSplunkstoresindexes#Bucket_naming_conve...

hope it helps

[ddrillic]

Based on http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/HowSplunkstoresindexes#Clustered_buckets

It says -

-- Starting with 6.0, hot and warm replicated copies reside in the db directory, the same as for non-replicated copies.

[ddrillic]

Thank you @adonio - in the document, you referred to, I don't see a reference to the hot bucket replication process.

[adonio]

the reference is for the naming convention. once a hot bucket is created, a replicated hot bucket is created as well. and when it rolls to warm, bucket are in read only status, therefore, in best scenario, no more replication is needed.
more refrences:
https://answers.splunk.com/answers/544921/when-the-hot-bucket-is-created-on-clustered-envioe.html
http://docs.splunk.com/Documentation/Splunk/7.2.1/Indexer/Howclusteredindexingworks

[ddrillic]

Got it ; -)

[ddrillic]

Thank you @adonio.