Hi all,
I deployed splunk in multi site clustering fashion.
everything is good but there are some challenges.
There are many indexes in my case. Some indexes are very important, but they generally have a small volume and replication is needed for these indexes. On the other hand, there are indexes that are less important but very bulky. Replication is not required for these indexes.
My question is what would you suggest to solve this problem.
Thank you
Changing repFactor does not remove the index from the cluster. It just means there is only one copy of the data for that index.
Set repFactor=0 in the indexes.conf stanza of each index you don't want replicated.
Thank you. But I think this causes the index go out of the cluster so that we can use clustering features with it. doesn't it?
Changing repFactor does not remove the index from the cluster. It just means there is only one copy of the data for that index.