Splunk Search

Replication and search factors "not met"

davidmills
Explorer

We have:
- Index Cluster Master
- Search head cluster (3 nodes)
- Index Cluster (3 nodes)
- Heavy forwarder (1 node)
- Configuration manager
- API collector

None have a repFactor setting in /opt/splunk/etc/system/local/indexes.conf. All have "repFactor = 0" in /opt/splunk/etc/system/default/indexes.conf.

"search_factor = 2" is set in all the default server.conf files and is set on the Index Cluster Master in /opt/splunk/etc/system/local/server.conf - "search_factor = 2"

"replication_factor = 3" is set in all the default server.conf files and is set to "replication_factor = 2" on the 3 search head clusters Index Cluster Master in /opt/splunk/etc/system/local/server.conf - "search_factor = 2"

Running "bin/splunk show cluster-status --verbose" produces:

Replication factor not met
Search factor not met

We are looking to upgrade from 6.5.3 to 7.2.4. Does any of the above need a resolution before attempting the upgrade?

Does the "not met" indicate that index replication if not functioning correctly?

Please advise.

Regards, David.

Tags (1)
0 Karma

tsaikumar009
Explorer

please put replication factor greater than search factor. Post that you should not see the same error anymore.

0 Karma

davidmills
Explorer

I set
replication_factor = 3
in all the places that it had been set to 2, then restarted every node in the enterprise cluster.
But re-running "bin/splunk show cluster-status --verbose" still produces:

Replication factor not met
Search factor not met

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.