Does an increase in the number of Indexers require more storage?

[glancaster]

Hello,

I'm talking about the DB locations that are remote. The amount of incoming data is not changing and we are only adding indexers to increase performance.

Say if I double the amount of indexers, do I need to double the amount of space allocated for the hot/warm/cold DBs? Do I need to adjust my indexes.conf?

I think I will need to go in and reduce my maxTotalDataSizeMB parameter by 50% but how do I do this gracefully while I incorporate the new Indexers? I wouldn't want to toss out half of the data that is on my current indxer group.

Any ideas are appreciated.

[lguinn2 · Accepted solution]

Let's say that you had 2 indexers, each with 1 TB storage for indexes, and you had sized your indexes so that they would not grow beyond 2 TB total. Hopefully, your forwarders are distributing the inputs fairly equally between these two indexers.

Now you want to add 2 more indexers.

Ultimately, if you still want to have a total of 2TB, each indexer should only configure 500 Gb (4 indexers, each with 1/4 of the storage). But if you reduce the size of the indexes on the old indexers, you will cause them to discard older buckets to get down to the size limit.

I would do this

• leave the size of the storage on the old indexers as it is
• allocate storage on the new indexers at 500 GB per indexer
• have the forwarders distribute data to all 4 indexers
• set time limits on each index (frozenTimePeriodInSecs) so that data is retired from all indexers based on time, not just size

After enough time has passed for the old indexers to have retired some data, you should be able to downsize the indexes on the old indexers without losing data.

[glancaster]

lguinn, thank you for the answer and it does help point to the proper way to handle this type of situation.

This will take some evaluation of 'data size' compared to 'data age' but I suppose that is a good thing to be aware of in my environment.