Deployment Architecture

Unequal number of Buckets in indexer clustering.

Explorer

We have two indexers in our cluster and RF and SF are met. But the total number of buckets in one of the indexer is reducing day by day. present situation is, one indexer contain 25000 Buckets and other contain 5000 Buckets. Did anyone faced this type of situation? Please help me whether is this normal or need to worry?

0 Karma

Ultra Champion

It's interesting to see your view of the Indexer Clustering: Master Node

0 Karma

SplunkTrust
SplunkTrust

Hi motkarnaresh,

looks wierd to me. I also administer a indexer cluster and I'm used to seeing diffences in bucket count aswell, but nothing that looks this extreme.

How much data are you indexing on average per day?
As TStrauch said, whats your RF?

What you could do for troubleshooting is following this documentation to list excess buckets.
https://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Removeextrabucketcopies

Don't remove them yet, just maybe show us the results of the splunk list excess-buckets command.

0 Karma

Explorer

Hi Pyro_wood,

There is nothing in excess-buckets list. Our SF=2 and RF=2 and we have only two indexers.
Our Splunk version is 6.3.1

0 Karma

Communicator

What is your search and replication faktor?

0 Karma

Explorer

SF=2 and RF=2 and we have two indexers.

0 Karma