Splunk Data Stream Processor

Indexer malfunction and bucket policy

Rozal
Engager

When one of the indexers fails, I have a problem with the growth of buckets on the working indexer.
If one of the indexers is not available, should I change the bucket policy? I currently have RF:2 SF:2

Labels (3)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

When your indexer goes down in cluster then CM try to spread out all buckets with your current indexers. This means that every indexers will divide those buckets which failed indexers have. In normal situation you shouldn't change SF&RF on this situation. Instead of you should fix that failed indexers and bring it back to cluster. After that cluster will rebalance buckets with all available indexers.

Basically indexer clusters works as it should.

But for that reason you should have enough spare space on those peers to manage situation when one (or even more, based on your RF&SF) can be down for some time. Other option is that your peers frozen some buckets to have enough space for normal operations. Of course this needs that you are using volumes with suitable max limit.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

When your indexer goes down in cluster then CM try to spread out all buckets with your current indexers. This means that every indexers will divide those buckets which failed indexers have. In normal situation you shouldn't change SF&RF on this situation. Instead of you should fix that failed indexers and bring it back to cluster. After that cluster will rebalance buckets with all available indexers.

Basically indexer clusters works as it should.

But for that reason you should have enough spare space on those peers to manage situation when one (or even more, based on your RF&SF) can be down for some time. Other option is that your peers frozen some buckets to have enough space for normal operations. Of course this needs that you are using volumes with suitable max limit.

r. Ismo

Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...