Hi guys.
I had a single-site indexer cluster with replication_factor 3. Migrated to multisite cluster with parameters:
site_replication_factor = origin:2,total:3
site_search_factor = origin:1,total:2
constrain_singlesite_buckets = false
After migrate I've 4 replicated bucket copies: 3 in old site and 1 in new site. I already add some configuration manually like this
search_factor = 2
replication_factor = 2
But there are still 3 copies in the old cluster.
What can I do to remove the extra data from the cluster?
Splunk Enterprise
Version:
7.2.1
Build:
be11b2c46e23
remove excess buckets
https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Removeextrabucketcopies
No results.
Splunk Atom Feed: clustermasterbuckets
Updated: 2019-02-13T16:02:37+03:00 Splunk build: 7.2.1
Feed links: create - _acl -
splunk_server currentDBSizeGB maxTotalDataSizeGB totalEventCount eai:acl.app
1 splunk-idx11 384 500 2571516578 _cluster
2 splunk-idx12 272 500 1827380397 _cluster
3 splunk-idx13 419 500 2893046932 _cluster
4 splunk-idx20 68 500 521531899 _cluster
5 splunk-idx21 72 500 566775305 _cluster
6 splunk-idx22 71 500 552783442 _cluster
7 splunk-idx23 77 500 611006777 _cluster
8 splunk-idx24 77 500 602144046 _cluster
9 splunk-idx25 67 500 524328395 _cluster
10 splunk-idx26 70 500 549058168 _cluster
11 splunk-idx27 75 500 589072469 _cluster
12 splunk-idx28 63 500 488439975 _cluster
13 splunk-idx29 67 500 516032474 _cluster
I have already used this commands but I still have extra copies. Why I still have 3 copies in old part of single-site indexer cluster
(site1) and new replicated copies in site2?