Does splunk enterprise trial support index replication?

[sympatiko]

Hi,

Good day! Just want to know if splunk enterprise trial support index replication?

Thanks,
Eddel

[gfuente · Accepted solution]

Hello

Enterprise Trial license is full featured, so yes it supports index replication. But after the trial if you convert the License to Free then you will lose some features

Regards

[sympatiko]

Hi gfuente,

Thanks for your quick help. My setup is a replication factor of 2 and search factor 1. I have this situation wherein I tried to shutdown my indexer 1 I assume that replication is happening then tried to search for a data and those stored on the indexer1 doesn't showed.
Any tips?

Thanks so much

[sympatiko]

Very much thankful!! You save me!

[sympatiko]

Thanks so much! It means the disk usage will be doubled? I read this blog http://blogs.splunk.com/2013/01/31/disk-space-estimator-for-index-replication/ . As I've understand it will still divided by the number of RF? Is it? I'm currently having a capacity plan for my setup of 5GB/day with 3 indexers and 1 search head. Having maximum of 15 concurrent searches a day.

Thanks so much!!

[gfuente]

Yes, you will need additional space for that extra copy of searchable data. But if you require data available when one peer goes down then you need that additional space...

You can use this calculator to estimate your storage requirements:

http://splunk-sizing.appspot.com/#c=1&i=2&sf=2&st=v&v=10

Regards

[sympatiko]

Hi gfuente,

Thank u so much for your time. It means I need to have additional search head for search replication of 2?

Thanks,

[gfuente]

Not at all. You can have 1 Search Head, and 2 Indexers with RF=2 and SF=2. SF is not related with the number of search Heads. Search Factor defines how many number of copies of the index files are replicated, while Replication Factor is the same but for the raw data.

[gfuente]

You need both factors at 2, search replication at 2, to have the data "searchable" in case of failure of 1 indexer

Regards