Getting Data In

Can I configure index to replicate in clustering environment?

Takajian
Builder

I am thinking to use data duplication function in clustering environment. As I do not need to duplicate summary index, I would like to configure which index to duplicate in clustering environment. Does somebody know if it is possible? If possible, please let me know how to configure?

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

You should be able to set the replication factor for a specific index using the repFactor parameter in indexes.conf.

The description of this option is here:

repFactor = <nonnegative integer>|"auto"
        * Only relevant if this instance is a clustering slave (but see note about "auto" below).
        * See server.conf spec for details on clustering configuration.
        * Value of 0 turns off replication for this index.
        * If set to "auto", slave will use whatever value the master is configured with
        * Highest legal value is 4294967295

If you want to dictate that a given index should not be replicated, set repFactor = 1.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...