Deployment Architecture

What will be the Impact of scaling up a multisite indexer cluster?

sushree1234
Explorer

Hi ,
I have a multisite indexer cluster (3 sites , 2 indexers each, total 6 indexers) . 
we have kept - 
site_replication_factor = origin:2,total:5 
site_search_factor = origin:2,total:4  

we have this query , if we scale up the indexer cluster and add up more indexers and change the site_replication_factor & site_search_factor accordingly , then what will be the impact on the whole architecture . anything we need to take care of before scaling up the architecture . Let me know .

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

what is the purpose of your multisite cluster? To answer this usually tolds what to put on SF and RF values also we should known how many peers you have on each site. Personally I use SF&RF like #sites as total when # sites >=3 (otherwise like SF=2 and RF=3 or RF=2). But if you have lot of sites then it's probably not needed to increase SF&RF until it reach #sites. Especially if you are using SmartStore those must be equal. IMHO the only reason to use bigger SF&RF is when you have unreliable HW which crash/go down regularly and this generates need to rebuild those buckets. But also in that cases you should fix you HW instead of just increasing SF&RF.

To increasing peers on sites gives you a better search performance when you buckets have speared equally over peers. In your cases I just change RF=SF=3 and just add needed amount of new peers to those sites. Especially no need to increase those. If/when your multisite cluster is on AWS with 3AZ then you should consider to take SmartStore (S3 buckets) into use if your searches are mostly covered 1-3month time and you can add enough cache.

r. Ismo

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sushree1234,

adding more Indexers you'll have better performaces because you add more calculation power,

changing the replication and search factors doesn't impact on performances.

Obviously you need more resources and more storage.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...