Deployment Architecture

If we add additional indexer to existing clustered indexers, how will we spread primary and replication buckets?

splunkreal
Motivator

Hello guys,

if we add new indexer to existing cluster of 3 indexers with RF=3 and SF=3, how will be spread primary and replicated buckets?

Will 4th indexer receive replicated buckets too?

Thanks.

 

* If this helps, please upvote or accept solution 🙂 *
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

yes, as @somesoni2 sayd, the replicated buckets are distributed in four peers instead of three, so you concumes less disk space in each peer.

This because having 3 peers and RF=3 and SF=3 you have all the data and tsx-indexes in all the peer, instead having 4 peers and the same RF and RS, buckets are more distributed.

Ciao.

Giuseppe

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The primaries will be rebalanced after new peer (indexer) joins the indexer cluster but it will not be effective as new indexer doesn't have bucket copies (it'll only have copies of data being ingested after it was added. 

To make sure you're distributing buckets uniformly, you should first do the data rebalance after the new indexer is joined, based on the RF/SF you selected. (see https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...). This will ensure new peer has almost same number of bucket copies as other. After that manually trigger primary rebalance so that primary buckets. (see this https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...)

https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...

splunkreal
Motivator

Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

you can add a new peer to an existing cluster following the steps at https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Addclusterpeer

You can also change RF and SF, but anyway, Splunk will align the new peer replicating buckets in a not long time that depends on the dimension of the archives.

You haven't to do nothing, it's an automatic job that you can monitor in the Master Node [Settings -- Indexer Clustering].

Ciao.

Giuseppe

splunkreal
Motivator

Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

yes, as @somesoni2 sayd, the replicated buckets are distributed in four peers instead of three, so you concumes less disk space in each peer.

This because having 3 peers and RF=3 and SF=3 you have all the data and tsx-indexes in all the peer, instead having 4 peers and the same RF and RS, buckets are more distributed.

Ciao.

Giuseppe

splunkreal
Motivator

Hi @gcusello @somesoni2 should new indexer have same storage capacity even if we keep same RF/SF=2?

Thanks a lot.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal ,

usually it's better that all Indexers have the same storage capacity because the use the same disk space.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...