Splunk Enterprise

If I increase the RF on a SmartStore enabled indexer cluster what happens on SmartStore?

cybersecnutant
Explorer

If I increase the RF on a SmartStore enabled indexer cluster what happens on SmartStore? Is a 2nd copy actually created on SmartStore, or is the same copy referenced by more than 1 indexer in the cluster? 

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @cybersecnutant,

Yes, you should be covered. As @PickleRick describe, there will be no change on remote storage, only your hot buckets will ve replicated between indexers local storage until they rolled to warm.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

marnall
Motivator

With SmartStore, replication and search factors only apply to hot buckets on the local machines. The idea is that the remote storage takes responsibility for the high availability and redundancy of the buckets. Thus, even adjusting your RF, it will not change the number of bucket copies on the remote storage.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's a bit more complicated than that. Hot buckets are normally streamed to other peers to meet RF/SF.

But when the bucket rolls to warm, it's uploaded to smartstore (which then takes care of data resilience) and local copies can be evicted to make room for frequently used cached buckets.

So initially you might get RF/SF meeting number of copies for a warm buckets but at any time the cache manager can decide to evict such warm copy untill it will be needed - then it will be re-downloaded from smartstore.

But yes, for warm buckets there is no longer replication between peers to meet RF/SF. And each bucket is just copied once to smartstore and it's smartstore's responsibility to make sure that bucket is available.

isoutamo
SplunkTrust
SplunkTrust

And it’s essential that RF = SF on before and after SmartStore is enabled. If not then there is possibility that bucket which is copied to S3 doesn’t contains searchable metadata and then it’s not working layter!

cybersecnutant
Explorer

I plan on going from RF1/SF1 to RF2/SF2 at the time. So should I be covered then?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...