Good afternoon I hva e splunk srchitecture: 1 seach 2 indexers in cluster 1 master node/License Server 1 Moniotoring Console/Deploymen server 2 Heavy forwarders SF=2 RF=2 I added a n...
i know that setting RF=2 ensures 2 copies of buckets on available indexers. so this consume 2X times of space/disk. now i also know that only the primary copy is searchable, ie SF=1 , is this the d...
Hi, We have 3 indexers and 1 search head (replication factor = 3).I need to permanently remove one indexer What is the correct procedure: 1. Change replication factor = 2 and then r...
Hi We are getting the following error message, I think I have a few options, but I am not sure what is the best. I have read this but still not sure what to do. https://docs.splunk.com/Documentati...
I'm getting ready to upgrade my cluster from 6.4.2 to 6.6.12 to 7.3.4. However, my Replication Factor and SearchFactor are net met. Is it OK to proceed with the upgrade anyway? If not, what can be d...
Hi Splunkers,
Question about replication factors and searchfactor in cluster environment.
If I have 8 indexers and 8 search heads with search and replication factors of 2 each, would I b...
...F08-44EA-B793-XXXXXXXXXXXX, frozen=1 The status for these buckets is-- Cannot fix search count as the bucket hasn't rolled yet. I try to roll them but nothing happens. Does frozen=1...
Hi,
Searchfactor and replication factor are not MET in our splunk deployment. I want to create a dashboard panel to be able to see the SearchFactor and Replication Factor. It can also be an a...