Deployment Architecture

If a peer goes down in an indexer cluster, how does new indexed data get replicated, and what happens when the peer comes back up later?

splunkn
Communicator

Little confused in Indexer Clustering. I have 3 peers with One master and One Search Head. Replication Factor is 3 and Search Factor is 2. If one of the indexers goes down, Master can manage with 2 searchable copies by moving the primacy and convert non-searchable into searchable. Search Factor is good, but in this case, my rep factor is 3 and number of peers also 3. If one of the peers goes down, RF could not be met and this cluster is valid, but incomplete. Two questions here:

  1. If new data comes, how does it get replicated? Is it going to store only two copies of data in available indexers (one original + one replicated)?

  2. What happen if my downed peer came back after one week? Whether the new data captured during last week is going to get copied in this peer?

Thanks in advance

0 Karma

jmallorquin
Builder

Hi,

For replication factor 3 you need 3 peers, in this case if your peers goes down the replication factor is not meet until you add other indexer, but your search factor will be meet after the fix process.

When your down peer goes up the master will rebuild the cluster make all the copies needed and yes after the rebuild all your peers will have a copy of the indexed data doesn't matter the time was down the indexer.

Hope i help you

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...