In an indexer cluster, if one indexer goes down, will any replicated bucket not be used in search?

[brdr]

We are on Splunk 6.6.2. We presently used indexer clustering. We have 2 indexers. The status of our cluster is:

• all data is searchable
• search factor is met
• replication factor is met

Per Splunk recommendation we use a factor of 2 for both search and replication.

All of our rb_ buckets on disk (on both indexers) have just the rawdata directory. There are no more files in rb_ bucket directory, i.e. no metadata.

If there is no metadata found under the rb_ folders, then it is not really searchable. If 1 indexer goes down then any replicated bucket will not be used by search. Is this true?

[skalliger]

Hi,

your my_index/db folder should have folders named db_ as well as rb_. In these bucket folders, metadata are stored in various files. It is not found in a folder like "my_index/db/metadata". There are files like bloomfilter, bucket_info.csv, Strings.data, Sources.data etc.

That's part of your metadata. And with a SF and RF of 2, you will be able to search all of your buckets when only one indexer goes down.

Skalli