Deployment Architecture

In an indexer cluster, if one indexer goes down, will any replicated bucket not be used in search?


We are on Splunk 6.6.2. We presently used indexer clustering. We have 2 indexers. The status of our cluster is:

  • all data is searchable
  • search factor is met
  • replication factor is met

Per Splunk recommendation we use a factor of 2 for both search and replication.

All of our rb_ buckets on disk (on both indexers) have just the rawdata directory. There are no more files in rb_ bucket directory, i.e. no metadata.

If there is no metadata found under the rb_ folders, then it is not really searchable. If 1 indexer goes down then any replicated bucket will not be used by search. Is this true?

0 Karma



your myindex/db folder should have folders named db as well as rb. In these bucket folders, metadata are stored in various files. It is not found in a folder like "myindex/db/metadata". There are files like bloomfilter, bucket_info.csv,, etc.

That's part of your metadata. And with a SF and RF of 2, you will be able to search all of your buckets when only one indexer goes down.


0 Karma