i am running Splunk on Kubernetes with SmartStore. In order to increase node CPU/memory utilization, I have collocated multiple indexers on the same nodes. (3 indexers per node with a total of 3 nodes). I am leveraging SmartStore.
I'd like to avoid a situation where one of the nodes crashes and all 3 replicas i had were there. I think there are 2 possible solutions for that:
SmartStore with write-through cache ?
Some kind of topology awareness - zones. Data are replicated across indexers belonging to different zones.