Deployment Architecture

What will be the Impact of scaling up a multisite indexer cluster?

sushree1234
Explorer

Hi ,
I have a multisite indexer cluster (3 sites , 2 indexers each, total 6 indexers) . 
we have kept - 
site_replication_factor = origin:2,total:5 
site_search_factor = origin:2,total:4  

we have this query , if we scale up the indexer cluster and add up more indexers and change the site_replication_factor & site_search_factor accordingly , then what will be the impact on the whole architecture . anything we need to take care of before scaling up the architecture . Let me know .

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

what is the purpose of your multisite cluster? To answer this usually tolds what to put on SF and RF values also we should known how many peers you have on each site. Personally I use SF&RF like #sites as total when # sites >=3 (otherwise like SF=2 and RF=3 or RF=2). But if you have lot of sites then it's probably not needed to increase SF&RF until it reach #sites. Especially if you are using SmartStore those must be equal. IMHO the only reason to use bigger SF&RF is when you have unreliable HW which crash/go down regularly and this generates need to rebuild those buckets. But also in that cases you should fix you HW instead of just increasing SF&RF.

To increasing peers on sites gives you a better search performance when you buckets have speared equally over peers. In your cases I just change RF=SF=3 and just add needed amount of new peers to those sites. Especially no need to increase those. If/when your multisite cluster is on AWS with 3AZ then you should consider to take SmartStore (S3 buckets) into use if your searches are mostly covered 1-3month time and you can add enough cache.

r. Ismo

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sushree1234,

adding more Indexers you'll have better performaces because you add more calculation power,

changing the replication and search factors doesn't impact on performances.

Obviously you need more resources and more storage.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...