Deployment Architecture
Highlighted

How many IngestionPipelines into single-site distributed environment with 3 indexers ?

New Member

Environment is single-site with 3 indexers and each indexer with parallelIngestionPipelines = 1(under /opt/splunk/etc/system/default/server.conf).

Does above imply that I have TOTAL "three" ingestion pipelines into my environment (one from each indexer) ?

If yes, with the setting of "maxHotBuckets=10" , would that mean I will have total limit of 30 hot buckets, considering 10 belonging to each ingestion pipeline ?

Labels (1)
0 Karma
Highlighted

Re: How many IngestionPipelines into single-site distributed environment with 3 indexers ?

SplunkTrust
SplunkTrust

Yes on the pipelines, yes but per index on the hot buckets.

0 Karma
Highlighted

Re: How many IngestionPipelines into single-site distributed environment with 3 indexers ?

New Member

Thanks Martin, I got your point.

Now, since I enabled maxHotBuckets to 10 for only one index out of 5 indexes.

Is it possible I can separate and validate Hot buckets count for this one index ? could you help me with some effective query here -
https://answers.splunk.com/answers/820336/how-to-validate-bucket-rotation-retention-paramete.html?mi...

0 Karma
Highlighted

Re: How many IngestionPipelines into single-site distributed environment with 3 indexers ?

SplunkTrust
SplunkTrust

| dbinspect can show you how many buckets there are, and what state they are in.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.