Deployment Architecture

Is it possible to limit bucket replication with limits.conf?

Path Finder

We recently set up a multisite with replication between the sites.
This is causing network congestion when it comes to replicating the buckets. Is there a way to limit this using something like the limits.conf?

0 Karma

Splunk Employee
Splunk Employee

No. Splunk's data streaming and "fixup" activity in the case of failure is designed to return the cluster to a healthy state as soon as possible. For "live data" streaming (we call this hot buckets), you're sending a copy of the data "slice" (~128kb by default) from the source indexer to as many peers as required to meet the replication factor. When you've got downtime or another event that requires "fixing" a cluster, you can throttle the number of jobs (that is, active simultaneous attempts to copy the data), but not the bandwidth consumed.

Unfortunately, if you're counting bytes on the WAN, you may not be ready for multi-site clustering.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!