Deployment Architecture

What will be the Impact of scaling up a multisite indexer cluster?

sushree1234
Explorer

Hi ,
I have a multisite indexer cluster (3 sites , 2 indexers each, total 6 indexers) . 
we have kept - 
site_replication_factor = origin:2,total:5 
site_search_factor = origin:2,total:4  

we have this query , if we scale up the indexer cluster and add up more indexers and change the site_replication_factor & site_search_factor accordingly , then what will be the impact on the whole architecture . anything we need to take care of before scaling up the architecture . Let me know .

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

what is the purpose of your multisite cluster? To answer this usually tolds what to put on SF and RF values also we should known how many peers you have on each site. Personally I use SF&RF like #sites as total when # sites >=3 (otherwise like SF=2 and RF=3 or RF=2). But if you have lot of sites then it's probably not needed to increase SF&RF until it reach #sites. Especially if you are using SmartStore those must be equal. IMHO the only reason to use bigger SF&RF is when you have unreliable HW which crash/go down regularly and this generates need to rebuild those buckets. But also in that cases you should fix you HW instead of just increasing SF&RF.

To increasing peers on sites gives you a better search performance when you buckets have speared equally over peers. In your cases I just change RF=SF=3 and just add needed amount of new peers to those sites. Especially no need to increase those. If/when your multisite cluster is on AWS with 3AZ then you should consider to take SmartStore (S3 buckets) into use if your searches are mostly covered 1-3month time and you can add enough cache.

r. Ismo

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sushree1234,

adding more Indexers you'll have better performaces because you add more calculation power,

changing the replication and search factors doesn't impact on performances.

Obviously you need more resources and more storage.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...