Deployment Architecture

What will be the Impact of scaling up a multisite indexer cluster?

sushree1234
Explorer

Hi ,
I have a multisite indexer cluster (3 sites , 2 indexers each, total 6 indexers) . 
we have kept - 
site_replication_factor = origin:2,total:5 
site_search_factor = origin:2,total:4  

we have this query , if we scale up the indexer cluster and add up more indexers and change the site_replication_factor & site_search_factor accordingly , then what will be the impact on the whole architecture . anything we need to take care of before scaling up the architecture . Let me know .

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

what is the purpose of your multisite cluster? To answer this usually tolds what to put on SF and RF values also we should known how many peers you have on each site. Personally I use SF&RF like #sites as total when # sites >=3 (otherwise like SF=2 and RF=3 or RF=2). But if you have lot of sites then it's probably not needed to increase SF&RF until it reach #sites. Especially if you are using SmartStore those must be equal. IMHO the only reason to use bigger SF&RF is when you have unreliable HW which crash/go down regularly and this generates need to rebuild those buckets. But also in that cases you should fix you HW instead of just increasing SF&RF.

To increasing peers on sites gives you a better search performance when you buckets have speared equally over peers. In your cases I just change RF=SF=3 and just add needed amount of new peers to those sites. Especially no need to increase those. If/when your multisite cluster is on AWS with 3AZ then you should consider to take SmartStore (S3 buckets) into use if your searches are mostly covered 1-3month time and you can add enough cache.

r. Ismo

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sushree1234,

adding more Indexers you'll have better performaces because you add more calculation power,

changing the replication and search factors doesn't impact on performances.

Obviously you need more resources and more storage.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...