Splunk Enterprise

Search Factor and Replication Factor not met

PJR
Engager

Hello all,

Our current environment is :

Three site clustered, 2 clusters on on-premises(14 indexers 7 indexers in each cluster) and one cluster(7 indexers) is hosted on AWS.

The AWS indexers are  clustered  recently. It is almost 15 days, but still the replication factor and search factor are not met. What might be the reason and what are all the possible ways that I can resolve this.

There are around 300 fixup tasks pending. The number remained the same for the past 2 weeks. I've manually rolled the buckets but still no use. 

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check splunkd.log for replication errors.

Verify the AWS security groups allow communication among all indexers on ports 8080 and 9887 and to the Cluster Manager's port 8089.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PJR
Engager

Hello richgalloway

I've checked for the splunkd.log for the past 1 week - no errors found.

8080 is closed even on the old clusters but we never had troubles with Replication and Search Factor. 

9887 and 8089 ports are all open across all the clusters.

But still the fixup tasks pending - 301

Fixup tasks - In progress - 0

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...