Splunk Enterprise

If I increase the RF on a SmartStore enabled indexer cluster what happens on SmartStore?

cybersecnutant
Explorer

If I increase the RF on a SmartStore enabled indexer cluster what happens on SmartStore? Is a 2nd copy actually created on SmartStore, or is the same copy referenced by more than 1 indexer in the cluster? 

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @cybersecnutant,

Yes, you should be covered. As @PickleRick describe, there will be no change on remote storage, only your hot buckets will ve replicated between indexers local storage until they rolled to warm.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

marnall
Motivator

With SmartStore, replication and search factors only apply to hot buckets on the local machines. The idea is that the remote storage takes responsibility for the high availability and redundancy of the buckets. Thus, even adjusting your RF, it will not change the number of bucket copies on the remote storage.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's a bit more complicated than that. Hot buckets are normally streamed to other peers to meet RF/SF.

But when the bucket rolls to warm, it's uploaded to smartstore (which then takes care of data resilience) and local copies can be evicted to make room for frequently used cached buckets.

So initially you might get RF/SF meeting number of copies for a warm buckets but at any time the cache manager can decide to evict such warm copy untill it will be needed - then it will be re-downloaded from smartstore.

But yes, for warm buckets there is no longer replication between peers to meet RF/SF. And each bucket is just copied once to smartstore and it's smartstore's responsibility to make sure that bucket is available.

isoutamo
SplunkTrust
SplunkTrust

And it’s essential that RF = SF on before and after SmartStore is enabled. If not then there is possibility that bucket which is copied to S3 doesn’t contains searchable metadata and then it’s not working layter!

cybersecnutant
Explorer

I plan on going from RF1/SF1 to RF2/SF2 at the time. So should I be covered then?

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...