Getting Data In

Replication factor calculation



I have 2 sites

2 Indexer cluster master

2 deployers

30 Indexers

30 Search Heads

What is the Replication factor and search head factor?

Labels (1)
Tags (1)
0 Karma



If I read this right, you have two identical sites with single site IDX clusters. Probably you also have shared SHs to both sites as individual SHCs?

Based on that I said that “normal” SF=2 and RF=3 should be enough. Of course you could increase those, but mostly that just generate more disk usage and costs without any real benefits.

Why you have two CM and two Deployer? Also I’m wondering your SH count vs. IDX count.
r. Ismo

0 Karma

Ultra Champion

Replication and search factors are not imposed on you by the number of servers (well, of course you can't have more copies of a single bucket than splunk instances - that's a limitation). It's up to you to configure it according to your needs.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...