In a clustered index implementation, should global setting for repFactor = auto?

[transtrophe]

Background ---
I am just starting the construction of an distributed implementation that will use index and search-head clustering. Clustering is up without any issues. Now I am planning the implementation of additional indexes to the standard defaults for distribution from the master to the peers. I am using the indexes.conf that was in $SPLUNK_HOME/etc/system/default, making modifications to copied version prior to relocating to $SPLUNK_HOME/etc/system/local for distribution.

Issue ---
I observe that in the default indexes.conf there is a global setting for repFactor = 0 (no replication), which the default indexes (including main - which is also set to be the default DB) inherits. I am setting the repFactor = auto for my new indexes in their respective stanzas but wanted clarification on the following issues:

1. Should I just set repFactor = auto globally without a specific "local" setting in each index stanza, including adding the repFactor = auto setting to the existing [main] stanza?
2. Since I am specifying the homePath and coldPath directories in the new index stanzas, do I need to build those on each peer including setting the directory properties, or does the bundling process do that?

[esix_splunk · Accepted solution]

Most direct answer to your questions:

1) If you set this global, then you do not need to set it a the index level, it will be inhereited. Best practices.. Well setting this globally is fine, as it will be inhereited. If you want to make indexes that are not replicated, then you can set the repfactor per index.

2) Bundling process will create these automatically when theses are applied to the peers and the indexers restart.

[transtrophe]

Kind of thought so but wanted to get a confirmation. Thanks.