Deployment Architecture

What should we do with the replication factor when half of the indexers are off?


Half of the eight indexers will be off for potentially a day, so we'll have four indexers available for that time. Our replication/search factor is 2:2 and we wonder whether to leave it as 2:2, increase it to 3:3 or take it down to 1:1.

Labels (1)
0 Karma

Have you S2 in use or multisite cluster or traditional single site cluster with local disks/volumes?
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...