Deployment Architecture

How many IngestionPipelines into single-site distributed environment with 3 indexers ?

sagaraverma
Loves-to-Learn Everything

Environment is single-site with 3 indexers and each indexer with parallelIngestionPipelines = 1(under /opt/splunk/etc/system/default/server.conf).

Does above imply that I have TOTAL "three" ingestion pipelines into my environment (one from each indexer) ?

If yes, with the setting of "maxHotBuckets=10" , would that mean I will have total limit of 30 hot buckets, considering 10 belonging to each ingestion pipeline ?

Labels (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes on the pipelines, yes but per index on the hot buckets.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

| dbinspect can show you how many buckets there are, and what state they are in.

0 Karma

sagaraverma
Loves-to-Learn Everything

Thanks Martin, I got your point.

Now, since I enabled maxHotBuckets to 10 for only one index out of 5 indexes.

Is it possible I can separate and validate Hot buckets count for this one index ? could you help me with some effective query here -
https://answers.splunk.com/answers/820336/how-to-validate-bucket-rotation-retention-paramete.html?mi...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...