Getting Data In

Data Archiving and Clusters

mcclainsm47
Engager

I have a clustered Splunk set up with 3 indexing peers and a replication factor of 3. There are a couple of indexes that need to be archived when frozen instead of deleted, but I want to avoid having duplicate copies. The documentation mentions: "You cannot solve this problem by archiving just the data on a single node, since there's no certainty that a single node contains all the data in the cluster."

However, I'm thinking that only applies when you've got more indexers than your search factor. Since the number of indexers = replication factor, each server should have all the buckets and thus I would be able to just keep buckets from one of them. Am I missing something?

Tags (2)
1 Solution

mahamed_splunk
Splunk Employee
Splunk Employee

Yes, at the time of archiving if the cluster master dashboard is green, then you can take backup from a single server.

View solution in original post

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

Yes, at the time of archiving if the cluster master dashboard is green, then you can take backup from a single server.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...