Splunk Data Stream Processor

Indexer malfunction and bucket policy

Rozal
Engager

When one of the indexers fails, I have a problem with the growth of buckets on the working indexer.
If one of the indexers is not available, should I change the bucket policy? I currently have RF:2 SF:2

Labels (3)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

When your indexer goes down in cluster then CM try to spread out all buckets with your current indexers. This means that every indexers will divide those buckets which failed indexers have. In normal situation you shouldn't change SF&RF on this situation. Instead of you should fix that failed indexers and bring it back to cluster. After that cluster will rebalance buckets with all available indexers.

Basically indexer clusters works as it should.

But for that reason you should have enough spare space on those peers to manage situation when one (or even more, based on your RF&SF) can be down for some time. Other option is that your peers frozen some buckets to have enough space for normal operations. Of course this needs that you are using volumes with suitable max limit.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

When your indexer goes down in cluster then CM try to spread out all buckets with your current indexers. This means that every indexers will divide those buckets which failed indexers have. In normal situation you shouldn't change SF&RF on this situation. Instead of you should fix that failed indexers and bring it back to cluster. After that cluster will rebalance buckets with all available indexers.

Basically indexer clusters works as it should.

But for that reason you should have enough spare space on those peers to manage situation when one (or even more, based on your RF&SF) can be down for some time. Other option is that your peers frozen some buckets to have enough space for normal operations. Of course this needs that you are using volumes with suitable max limit.

r. Ismo

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...