- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello guys,
if we add new indexer to existing cluster of 3 indexers with RF=3 and SF=3, how will be spread primary and replicated buckets?
Will 4th indexer receive replicated buckets too?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @splunkreal,
yes, as @somesoni2 sayd, the replicated buckets are distributed in four peers instead of three, so you concumes less disk space in each peer.
This because having 3 peers and RF=3 and SF=3 you have all the data and tsx-indexes in all the peer, instead having 4 peers and the same RF and RS, buckets are more distributed.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The primaries will be rebalanced after new peer (indexer) joins the indexer cluster but it will not be effective as new indexer doesn't have bucket copies (it'll only have copies of data being ingested after it was added.
To make sure you're distributing buckets uniformly, you should first do the data rebalance after the new indexer is joined, based on the RF/SF you selected. (see https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...). This will ensure new peer has almost same number of bucket copies as other. After that manually trigger primary rebalance so that primary buckets. (see this https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @splunkreal,
you can add a new peer to an existing cluster following the steps at https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Addclusterpeer
You can also change RF and SF, but anyway, Splunk will align the new peer replicating buckets in a not long time that depends on the dimension of the archives.
You haven't to do nothing, it's an automatic job that you can monitor in the Master Node [Settings -- Indexer Clustering].
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @splunkreal,
yes, as @somesoni2 sayd, the replicated buckets are distributed in four peers instead of three, so you concumes less disk space in each peer.
This because having 3 peers and RF=3 and SF=3 you have all the data and tsx-indexes in all the peer, instead having 4 peers and the same RF and RS, buckets are more distributed.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @gcusello @somesoni2 should new indexer have same storage capacity even if we keep same RF/SF=2?
Thanks a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @splunkreal ,
usually it's better that all Indexers have the same storage capacity because the use the same disk space.
Ciao.
Giuseppe
