Hi, I have done a lot of researching about sizing a Splunk Cluster and have a few in deep questions: Settings: 100 GB a Days Index Tage; 3 Node Cluster; RF/SF 2 Scenario 1: All Nodes Up and Running; Disk Space per Node = 100 GB * CompressionFactor * Retention * RF/SF / 3 --> Nothing fancy. Scenario 2: One Peere Down; Disk Space Per Node = 100 GB * CompressionFactor * Retention * RF/SF / 2 --> As I can't loose buckets I have to get at least this much Diskpace on one of my indexers. First tought was that I could limit the size of the Indexes with maxTotalDataSizeMB (which is maxTotalDataSizeMB per Index per Peer Node). My problem (if I got this right, not testet in DEV Env right now): If Scenario 1 applies (all 3 nodes up), Size of the Index is limited by maxTotalDataSizeMB; When then one peer Nodes goes down Buckets will start to get replicated to the remaining two nodes causing maxTotalDataSizeMB so hit again (as maxTotalDataSizeMB does not only count primary buckets, but all buckets in the index --> right?) which will result i a loss of data? So with maxTotalDataSizeMB I wan't be able to "reserve" some head room of disk space for this scenario. Am I right that the only way to garantee that I will not lose any data in a indexer cluster is to use maxWarmDBCount and frozenTimePeriodInSecs together (in order to save some headroom in case a peer node fails)? Thanks for your help! ... View more

Hi, Is there any chance to order the Sankey chart elements on the x-axis? I have the problem that the Sankey chart shows the correct results, but the order is not how I want them. As you can see in the attached screenshot, the order of the nodes is: 1, 3, 2, 4, 5; However I need to have them 1,2,3,4,5;. Thanks for your suggestions, Christoph ... View more