How to increase the replication factor?

[joonoyang]

Hi,

I have three indexers and it has 2 replication factor for now. I'm considering to add 1 more indexer and increase the current replication factor with 4. Is there any procedure to do that, such as changing Master with Maintain mode, edit server.conf and then restart?

Thanks in advance.
Joon

[martin_mueller]

With the warning from @ddrillic in mind, you can edit server.conf on the cluster master and restart it to change this.
Setting maintenance mode before the restart won't hurt, but it won't accomplish much either. After the master restart and turning off maintenance mode the peers will start the replication frenzy one way or another.

Best done after hours on a Friday to move the replication frenzy to the weekend.

[ddrillic]

I wouldn't rush such a decision to increase the replication factor from two. The replication process is really intense on the entire splunk platform and with replication factor of two, the data is always available even if one indexer is down, for any reason.