Deployment Architecture

How many IngestionPipelines into single-site distributed environment with 3 indexers ?

sagaraverma
Loves-to-Learn Everything

Environment is single-site with 3 indexers and each indexer with parallelIngestionPipelines = 1(under /opt/splunk/etc/system/default/server.conf).

Does above imply that I have TOTAL "three" ingestion pipelines into my environment (one from each indexer) ?

If yes, with the setting of "maxHotBuckets=10" , would that mean I will have total limit of 30 hot buckets, considering 10 belonging to each ingestion pipeline ?

Labels (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes on the pipelines, yes but per index on the hot buckets.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

| dbinspect can show you how many buckets there are, and what state they are in.

0 Karma

sagaraverma
Loves-to-Learn Everything

Thanks Martin, I got your point.

Now, since I enabled maxHotBuckets to 10 for only one index out of 5 indexes.

Is it possible I can separate and validate Hot buckets count for this one index ? could you help me with some effective query here -
https://answers.splunk.com/answers/820336/how-to-validate-bucket-rotation-retention-paramete.html?mi...

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...