Thanks for your response. ... View more

I have replication_factor = 2 and search_factor = 2. According to the documentation "When you start or restart a master or peer node, the master rebalances the set of primary bucket copies across the peers.... to achieve rebalancing, the master reassigns the primary state from existing bucket copies to searchable copies". If I set search_factor=1, instead of 2, will rebalancing occur when an indexer is restarted and comes up before the heartbeat timeout ? I won't have searchable copies on the other indexers, so shouldn't that stop the primary re-assignment from occurring? There really should be a property file that we could use to turn rebalancing off or on. ... View more

I have a replication factor of 2, but am also using data model acceleration. Since the feature to replicate accelerated data model tsidx files is not available in Splunk yet, every indexer restart means that the re-assigned primary buckets need to be re-accelerated. This is a huge resource drain and can take days in a large system. It would be better if the primaries were not re-assigned - then I would not have to rebuild the accelerated data model tsidx files. ... View more