Increasing Replication and Search Factor

[shrutheen]

I have 3 Search Heads and 3 Indexers with Replication Factor =1 and Search Factor=1. My requirement is to increase this to RF=3 and SF=2

Each indexer has around 800GB of data.

Now if I increase the replication factor to 3 does it mean each indexer will end up with around 2.4TB of data post data rebalancing.

And what would be the approximate data size in each indexer if RF is set to 2.

[gcusello]

Hi @shrutheen,

The question is: I suppose that you have an Indexer Cluster, so why have you RF=1?

Anyway, I think that having 800 GB with RF=1 and SF=1 you shouldn't have 2400 GB with RF=3 and SR=2 because the tsindexes (SF) take around the 35% of the space required, so you should have for 100GB/day:

total row data = 100GB * 15% * RF = 45GB
tsindexes data = 100GB * 35% * SF = 70GB
total storage = 115GB
peer storage =total / 3 = 38.3GB

So what's the daily indexed logs of your infrastructure?

For this job is usually requested  at least a Splunk Architect, this isn't a job for the Community.

Ciao.

Giuseppe