Deployment Architecture

If we add additional indexer to existing clustered indexers, how will we spread primary and replication buckets?

splunkreal
Motivator

Hello guys,

if we add new indexer to existing cluster of 3 indexers with RF=3 and SF=3, how will be spread primary and replicated buckets?

Will 4th indexer receive replicated buckets too?

Thanks.

 

* If this helps, please upvote or accept solution 🙂 *
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

yes, as @somesoni2 sayd, the replicated buckets are distributed in four peers instead of three, so you concumes less disk space in each peer.

This because having 3 peers and RF=3 and SF=3 you have all the data and tsx-indexes in all the peer, instead having 4 peers and the same RF and RS, buckets are more distributed.

Ciao.

Giuseppe

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The primaries will be rebalanced after new peer (indexer) joins the indexer cluster but it will not be effective as new indexer doesn't have bucket copies (it'll only have copies of data being ingested after it was added. 

To make sure you're distributing buckets uniformly, you should first do the data rebalance after the new indexer is joined, based on the RF/SF you selected. (see https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...). This will ensure new peer has almost same number of bucket copies as other. After that manually trigger primary rebalance so that primary buckets. (see this https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...)

https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...

splunkreal
Motivator

Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

you can add a new peer to an existing cluster following the steps at https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Addclusterpeer

You can also change RF and SF, but anyway, Splunk will align the new peer replicating buckets in a not long time that depends on the dimension of the archives.

You haven't to do nothing, it's an automatic job that you can monitor in the Master Node [Settings -- Indexer Clustering].

Ciao.

Giuseppe

splunkreal
Motivator

Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

yes, as @somesoni2 sayd, the replicated buckets are distributed in four peers instead of three, so you concumes less disk space in each peer.

This because having 3 peers and RF=3 and SF=3 you have all the data and tsx-indexes in all the peer, instead having 4 peers and the same RF and RS, buckets are more distributed.

Ciao.

Giuseppe

splunkreal
Motivator

Hi @gcusello @somesoni2 should new indexer have same storage capacity even if we keep same RF/SF=2?

Thanks a lot.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal ,

usually it's better that all Indexers have the same storage capacity because the use the same disk space.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...