I do not understand why, but I appear to have missing data. We have 4 indexers in our cluster and in our server.conf filer replication_factor=4. Stopped splunkd on everything. We backed up each index, on each indexer (each folder under "/opt/splunk/var/lib/splunk/" on each index got backed up). Performed the necessary maint on the cluster. Took everything we backed up on "old indexer1" and put it back on "new indexer1", started splunkd, and had it replicate across the indexers.
But when I search the data from a search head, using the SPL, I know there is stuff missing.
Beyond going through each of my archives, finding what buckets are missing, and restore them, what am I missing? I assumed since replication_factor=4, that meant I had duplicate copies of all of my data across all 4 indexers. What am I missing?
1) How do you know stuff is missing?
2) are you missing a single index, or a certain time frame?
3) Why do you backup and restore data from 1 machine in your cluster? Wouldn't it be much simpelere too add a new machine and than remove the old one? Then splunk would take care of you repliaction.