Deployment Architecture

migrating from single server to indexer cluster with replicated data


i know this has been asked before, such as - but looking for clarification on replication and search factors.

If I were to start a 3-node indexer cluster with rf and sf set to 3, and copied all the buckets from the specific indexes to all nodes (including raw and index files), would all the historical data be searchable across the indexer cluster? i.e. is it enough to copy all the files there.

1 additional item to mention is that i may want to look at smartstore for some of the indexes, e.g. using S3, but still investigating the search usage to get a better idea of how far back data is being used and whether this might have a negative performance impact - if not, this is the way we'd want to go, and i believe sf/rf of 3 with 3 indexers would be needed for this.

splunk version is 7.3.1

0 Karma

Path Finder

Hi Brettcave,

I am not sure I understand your question completely but RF and SF are required to ensure you have data durability. I would not suggest to go for 3 rf and sf as u only have 3 indexers.

I would suggest to go for RF 2 and SF either 1 or 2 depending on requirements.

RF = 2 would mean that 2 copies of your data is available which would help in data availability in case of 1 of the server is not available

SF = 2 would mean you have 2 searchable copies. but this would also require more disk space as well.

0 Karma


Hey Akshatj2. What I am asking is:

If I have an existing data set on a single instance, and want to move that instance from standalone to clustered index, would the current dataset be searchable across the cluster if I were to copy all the buckets to all nodes?

With 3 indexers and a RF and SF of 3, it means each 1 of the nodes has a copy of the raw data AND index data, and so it can simplify backup solutions. I know it's not the best way to optimize space utilization, but it makes some of the management aspects a bit easier.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...