Recommended search/replication factor config for 2 site index cluster w/16 indexers each

[joesrepsolc]

Looking for any performance gains on our architecture and how best to take advantage of the (16) indexer clusters we have in place (1 cluster in CA, and another in midwest)

Today the replication factor = 2, and search factor = 2. Feeling like we can do better and increase performance.

Thoughts? Reasoning?

Thanks!

[lakshman239]

Assuming you have multi-site indexer cluster across 2 sites, what's your site search and replication factor? How many copies do you want to store in each site when a new data comes in? Look at your failover and storage considerations.

e.g. any data coming in site 1 can be stored in 2 indexers (or more if you want) in the originating site and another 2 copies in the other site. This will ensure equal amount of data in each site and fault tolerant up-to 2 nodes in a site.

Look at the examples in https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Sitereplicationfactor#Examples and your use cases, available storage to determine/adust Site SF/RF. Generally, distributing the copies equivally in both sites should give you a better performance. Also, if the users are across the world, you may also need to look at balancing them to both sites equally

https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Sitesearchfactor

[bangalorep]

Are you facing any performance issues?
Also, what is the data volume?

[joesrepsolc]

no performance problems persay... but something I want to understand better. Obviously looking for as-best of performance as possible out of our system. Doing roughly 4TB/day ingestion.

[adonio]

are those connected? e.g. multi-site cluster or separate indexer clusters?

[joesrepsolc]

It is a multi-site index cluster. (16) indexers at one site and (16) indexers at another site. All managed by a single cluster master.