Deployment Architecture

In a clustered index implementation, should global setting for repFactor = auto?

transtrophe
Communicator

Background ---
I am just starting the construction of an distributed implementation that will use index and search-head clustering. Clustering is up without any issues. Now I am planning the implementation of additional indexes to the standard defaults for distribution from the master to the peers. I am using the indexes.conf that was in $SPLUNK_HOME/etc/system/default, making modifications to copied version prior to relocating to $SPLUNK_HOME/etc/system/local for distribution.

Issue ---
I observe that in the default indexes.conf there is a global setting for repFactor = 0 (no replication), which the default indexes (including main - which is also set to be the default DB) inherits. I am setting the repFactor = auto for my new indexes in their respective stanzas but wanted clarification on the following issues:

  1. Should I just set repFactor = auto globally without a specific "local" setting in each index stanza, including adding the repFactor = auto setting to the existing [main] stanza?
  2. Since I am specifying the homePath and coldPath directories in the new index stanzas, do I need to build those on each peer including setting the directory properties, or does the bundling process do that?
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Most direct answer to your questions:

1) If you set this global, then you do not need to set it a the index level, it will be inhereited. Best practices.. Well setting this globally is fine, as it will be inhereited. If you want to make indexes that are not replicated, then you can set the repfactor per index.

2) Bundling process will create these automatically when theses are applied to the peers and the indexers restart.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

Most direct answer to your questions:

1) If you set this global, then you do not need to set it a the index level, it will be inhereited. Best practices.. Well setting this globally is fine, as it will be inhereited. If you want to make indexes that are not replicated, then you can set the repfactor per index.

2) Bundling process will create these automatically when theses are applied to the peers and the indexers restart.

transtrophe
Communicator

Kind of thought so but wanted to get a confirmation. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...