- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have an indexer cluster with a replication factor of 3. If I were to implement Hadoop Data Roll, would only one copy of each event be archived to Hadoop at freeze time, or would all three bucket copies be archived? I'm trying to find out if I can save in terms of raw archive storage costs by implementing HDR versus archiving frozen buckets to a set of NFS mounts.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HDR will only copy 1 journal.gz (raw data from the bucket). Therefore, 3X Splunk bucket replication will not impact the storage on the Hadoop side.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HDR will only copy 1 journal.gz (raw data from the bucket). Therefore, 3X Splunk bucket replication will not impact the storage on the Hadoop side.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HDR is by far the best archiving solution, unless you really want to write your own dedup logic (spoiler: you don't lol).