Deployment Architecture
Highlighted

How many IngestionPipelines into single-site distributed environment with 3 indexers ?

Loves-to-Learn Lots

Environment is single-site with 3 indexers and each indexer with parallelIngestionPipelines = 1(under /opt/splunk/etc/system/default/server.conf).

Does above imply that I have TOTAL "three" ingestion pipelines into my environment (one from each indexer) ?

If yes, with the setting of "maxHotBuckets=10" , would that mean I will have total limit of 30 hot buckets, considering 10 belonging to each ingestion pipeline ?

Labels (1)
0 Karma
Highlighted

Re: How many IngestionPipelines into single-site distributed environment with 3 indexers ?

SplunkTrust
SplunkTrust

Yes on the pipelines, yes but per index on the hot buckets.

0 Karma
Highlighted

Re: How many IngestionPipelines into single-site distributed environment with 3 indexers ?

Loves-to-Learn Lots

Thanks Martin, I got your point.

Now, since I enabled maxHotBuckets to 10 for only one index out of 5 indexes.

Is it possible I can separate and validate Hot buckets count for this one index ? could you help me with some effective query here -
https://answers.splunk.com/answers/820336/how-to-validate-bucket-rotation-retention-paramete.html?mi...

0 Karma
Highlighted

Re: How many IngestionPipelines into single-site distributed environment with 3 indexers ?

SplunkTrust
SplunkTrust

| dbinspect can show you how many buckets there are, and what state they are in.

0 Karma