Deployment Architecture

Replication factor change before indexer removing

michael_vi
Path Finder

Hi,

We have 3 indexers and 1 search head (replication factor = 3).I need to permanently remove one indexer 

What is the correct procedure:

1. Change replication factor = 2 and then remove indexer

OR

1. Remove indexer and after that change the replication factor to 2

 

Thanks

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Reduce the replication factor (and search factor if it's also 3) before removing the indexer.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Reduce the replication factor (and search factor if it's also 3) before removing the indexer.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing Splunk Enterprise Security 8.0!

Join us on Wednesday, November 20 to learn about Splunk Enterprise Security 8.0!To enhance SOC efficiency, ...

Mastering Threat Hunting

Register to watch Mastering Threat Hunting on Monday, November 18Join us for an insightful talk where we dive ...

Upcoming Community Maintenance: 10/28

Howdy folks, just popping in to let you know that the Splunk Community site will be in read-only mode ...