Getting Data In

Data Archiving and Clusters

Engager

I have a clustered Splunk set up with 3 indexing peers and a replication factor of 3. There are a couple of indexes that need to be archived when frozen instead of deleted, but I want to avoid having duplicate copies. The documentation mentions: "You cannot solve this problem by archiving just the data on a single node, since there's no certainty that a single node contains all the data in the cluster."

However, I'm thinking that only applies when you've got more indexers than your search factor. Since the number of indexers = replication factor, each server should have all the buckets and thus I would be able to just keep buckets from one of them. Am I missing something?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

Yes, at the time of archiving if the cluster master dashboard is green, then you can take backup from a single server.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Yes, at the time of archiving if the cluster master dashboard is green, then you can take backup from a single server.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!