Deployment Architecture

Replication factor change before indexer removing

michael_vi
Path Finder

Hi,

We have 3 indexers and 1 search head (replication factor = 3).I need to permanently remove one indexer 

What is the correct procedure:

1. Change replication factor = 2 and then remove indexer

OR

1. Remove indexer and after that change the replication factor to 2

 

Thanks

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Reduce the replication factor (and search factor if it's also 3) before removing the indexer.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Reduce the replication factor (and search factor if it's also 3) before removing the indexer.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...