Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Replication and Search factor
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunkers,
Question about replication factors and search factor in cluster environment.
If I have 8 indexers and 8 search heads with search and replication factors of 2 each, would I benefit in search speed increase by setting replication and/or search factors higher?
How much higher? What are the recommended replication/search factors for number of indexers, search heads?
Currently we are running into issues where search queries that take long time to execute, >10min, get reading errors while waiting for peers and Search results are incomplete.
Thank you for suggestions
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
Rep factor and search factor will define only "how many" indexers can you lose without impact to the service. With rep factor and search factor 2, you can lose only 1 of the 8 indexers, Increasing it to 3, will allow to lose 2 indexers before affecting the service.
So, you won´t get any performance gain increasing those settings. That´s because there is only one primary bucket of each copy, and that indexer is the one returning the results.
Regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
Rep factor and search factor will define only "how many" indexers can you lose without impact to the service. With rep factor and search factor 2, you can lose only 1 of the 8 indexers, Increasing it to 3, will allow to lose 2 indexers before affecting the service.
So, you won´t get any performance gain increasing those settings. That´s because there is only one primary bucket of each copy, and that indexer is the one returning the results.
Regards
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
How to Break a Kubernetes Pod on Purpose and Let the AI Troubleshooting Agent Find ...
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
