Deployment Architecture

Indexer Clustering Search Factor and Replication Factor not Met for Streaming Buckets

sat94541
Communicator

It is common to see that one or two buckets may not be meeting the Search Factor, although the data from the respective buckets will be searchable.

Many times these buckets are hot buckets, which mean these buckets will not meet the Search Factor unless the bucket is rolled from hot to warm. When you view these buckets using the Bucket REST endpoint using the URL below, the bucket will show status of 'StreamingSource' or 'StreamingTarget'

Bucket REST endpoint:
https://<CLUSTER_MASTER_URI>:<CLUSTER_MASTER_PORT>/services/cluster/master/buckets/<BUCKET_ID>

How to address such a situation?

0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Run the following curl command on the index where the bucket needs to be fixed.

HOST is the StreamingSource server name, PORT being 8089, YOUR_INDEX is the index needing to roll

 curl -k -u admin:changeme https://HOST:PORT/services/data/indexes/YOUR_INDEX/roll-hot-buckets -X POST

example of _audit something like

 curl -k -u admin:PASSWORD https://idx2:8089/services/data/indexes/_audit/roll-hot-buckets -X POST

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

Run the following curl command on the index where the bucket needs to be fixed.

HOST is the StreamingSource server name, PORT being 8089, YOUR_INDEX is the index needing to roll

 curl -k -u admin:changeme https://HOST:PORT/services/data/indexes/YOUR_INDEX/roll-hot-buckets -X POST

example of _audit something like

 curl -k -u admin:PASSWORD https://idx2:8089/services/data/indexes/_audit/roll-hot-buckets -X POST

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.