If we add additional indexer to existing clustered indexers, how will we spread primary and replication buckets?

[splunkreal]

Hello guys,

if we add new indexer to existing cluster of 3 indexers with RF=3 and SF=3, how will be spread primary and replicated buckets?

Will 4th indexer receive replicated buckets too?

Thanks.

[somesoni2]

The primaries will be rebalanced after new peer (indexer) joins the indexer cluster but it will not be effective as new indexer doesn't have bucket copies (it'll only have copies of data being ingested after it was added. 

To make sure you're distributing buckets uniformly, you should first do the data rebalance after the new indexer is joined, based on the RF/SF you selected. (see https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...). This will ensure new peer has almost same number of bucket copies as other. After that manually trigger primary rebalance so that primary buckets. (see this https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...)

https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...

[splunkreal]

Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?

Thanks.

[gcusello]

Hi @splunkreal,

you can add a new peer to an existing cluster following the steps at https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Addclusterpeer

You can also change RF and SF, but anyway, Splunk will align the new peer replicating buckets in a not long time that depends on the dimension of the archives.

You haven't to do nothing, it's an automatic job that you can monitor in the Master Node [Settings -- Indexer Clustering].

Ciao.

Giuseppe

[splunkreal]

Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?

Thanks.

[gcusello · Accepted solution]

Hi @splunkreal,

yes, as @somesoni2 sayd, the replicated buckets are distributed in four peers instead of three, so you concumes less disk space in each peer.

This because having 3 peers and RF=3 and SF=3 you have all the data and tsx-indexes in all the peer, instead having 4 peers and the same RF and RS, buckets are more distributed.

Ciao.

Giuseppe

[splunkreal]

Hi @gcusello @somesoni2 should new indexer have same storage capacity even if we keep same RF/SF=2?

Thanks a lot.

[gcusello]

Hi @splunkreal ,

usually it's better that all Indexers have the same storage capacity because the use the same disk space.

Ciao.

Giuseppe