disable relication for an index

[sigma]

Hi all,

I deployed splunk in multi site clustering fashion.

everything is good but there are some challenges.

There are many indexes  in my case. Some indexes are very important, but they generally have a small volume and replication is needed for these indexes. On the other hand, there are indexes that are less important but very bulky. Replication is not required for these indexes.
My question is what would you suggest to solve this problem.

Thank you

[richgalloway]

Set repFactor=0 in the indexes.conf stanza of each index you don't want replicated.

[sigma]

Thank you. But I think this causes the index go out of the cluster so that we can use clustering features with it. doesn't it?

[richgalloway · Accepted solution]

Changing repFactor does not remove the index from the cluster.  It just means there is only one copy of the data for that index.