Deployment Architecture

If I have an existing search head cluster with a replication factor of 3, should I increase this number when adding new search heads?

rcreddy06
Path Finder

I need to configure new search heads to an existing search head cluster, currently with a replication factor of 3. When I add the new search heads, should I increase the replication factor?

Please suggest me of any possible issues. Should I keep the replication factor as 3?

Command to configure the new search head:
./splunk init shcluster-config -auth admin:pw -mgmt_uri:mgmt_port <>:8089 -replication_port 8087 -replication_factor 3 -conf_deploy_url (ip of dep_server)-secret (pw)

Command to add to the cluster:
./splunk add shcluster-member -current_member_uri:mgmt_port (fqdn of any current member uri):8089

Richfez
SplunkTrust
SplunkTrust

It is not recommended to change the replication factor once it's been set at member initialization. Besides, there is no need to unless you wish to have greater redundancy and be able to tolerate more than two nearly simultaneous failures at one time. You can read up on both of those here in the sections "Effect of the replication factor" and "Replication factor configuration."

Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...