Getting Data In

Buckets naming convention for search factor in cluster

splunkreal
Motivator

Hello guys,

rb_ are replicated buckets of db_ - impacted by replication factor.

However how to identify search factor footprint (specific index or bucket name?) on indexers?

Thanks.

 

* If this helps, please upvote or accept solution if it solved *
Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
CM informs peers which one should have a searchable copies of buckets. This is not seen by bucket name. You could look inside bucket if there is a metadata present or only journal. If there is metadata then it’s a searchable otherwise not.
r. Ismo
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...