Deployment Architecture

What will be the Impact of scaling up a multisite indexer cluster?

sushree1234
Explorer

Hi ,
I have a multisite indexer cluster (3 sites , 2 indexers each, total 6 indexers) . 
we have kept - 
site_replication_factor = origin:2,total:5 
site_search_factor = origin:2,total:4  

we have this query , if we scale up the indexer cluster and add up more indexers and change the site_replication_factor & site_search_factor accordingly , then what will be the impact on the whole architecture . anything we need to take care of before scaling up the architecture . Let me know .

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

what is the purpose of your multisite cluster? To answer this usually tolds what to put on SF and RF values also we should known how many peers you have on each site. Personally I use SF&RF like #sites as total when # sites >=3 (otherwise like SF=2 and RF=3 or RF=2). But if you have lot of sites then it's probably not needed to increase SF&RF until it reach #sites. Especially if you are using SmartStore those must be equal. IMHO the only reason to use bigger SF&RF is when you have unreliable HW which crash/go down regularly and this generates need to rebuild those buckets. But also in that cases you should fix you HW instead of just increasing SF&RF.

To increasing peers on sites gives you a better search performance when you buckets have speared equally over peers. In your cases I just change RF=SF=3 and just add needed amount of new peers to those sites. Especially no need to increase those. If/when your multisite cluster is on AWS with 3AZ then you should consider to take SmartStore (S3 buckets) into use if your searches are mostly covered 1-3month time and you can add enough cache.

r. Ismo

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sushree1234,

adding more Indexers you'll have better performaces because you add more calculation power,

changing the replication and search factors doesn't impact on performances.

Obviously you need more resources and more storage.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...