Deployment Architecture

Replication factor change before indexer removing

michael_vi
Path Finder

Hi,

We have 3 indexers and 1 search head (replication factor = 3).I need to permanently remove one indexer 

What is the correct procedure:

1. Change replication factor = 2 and then remove indexer

OR

1. Remove indexer and after that change the replication factor to 2

 

Thanks

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Reduce the replication factor (and search factor if it's also 3) before removing the indexer.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Reduce the replication factor (and search factor if it's also 3) before removing the indexer.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...