Deployment Architecture

If we add additional indexer to existing clustered indexers, how will we spread primary and replication buckets?

splunkreal
Motivator

Hello guys,

if we add new indexer to existing cluster of 3 indexers with RF=3 and SF=3, how will be spread primary and replicated buckets?

Will 4th indexer receive replicated buckets too?

Thanks.

 

* If this helps, please upvote or accept solution if it solved *
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

yes, as @somesoni2 sayd, the replicated buckets are distributed in four peers instead of three, so you concumes less disk space in each peer.

This because having 3 peers and RF=3 and SF=3 you have all the data and tsx-indexes in all the peer, instead having 4 peers and the same RF and RS, buckets are more distributed.

Ciao.

Giuseppe

View solution in original post

somesoni2
Revered Legend

The primaries will be rebalanced after new peer (indexer) joins the indexer cluster but it will not be effective as new indexer doesn't have bucket copies (it'll only have copies of data being ingested after it was added. 

To make sure you're distributing buckets uniformly, you should first do the data rebalance after the new indexer is joined, based on the RF/SF you selected. (see https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...). This will ensure new peer has almost same number of bucket copies as other. After that manually trigger primary rebalance so that primary buckets. (see this https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...)

https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_clu...

splunkreal
Motivator

Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?

Thanks.

* If this helps, please upvote or accept solution if it solved *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

you can add a new peer to an existing cluster following the steps at https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Addclusterpeer

You can also change RF and SF, but anyway, Splunk will align the new peer replicating buckets in a not long time that depends on the dimension of the archives.

You haven't to do nothing, it's an automatic job that you can monitor in the Master Node [Settings -- Indexer Clustering].

Ciao.

Giuseppe

splunkreal
Motivator

Hello, so replicated buckets will also be distributed on this peer even if RF=3 and SF=3 are already met?

Thanks.

* If this helps, please upvote or accept solution if it solved *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

yes, as @somesoni2 sayd, the replicated buckets are distributed in four peers instead of three, so you concumes less disk space in each peer.

This because having 3 peers and RF=3 and SF=3 you have all the data and tsx-indexes in all the peer, instead having 4 peers and the same RF and RS, buckets are more distributed.

Ciao.

Giuseppe

splunkreal
Motivator

Hi @gcusello @somesoni2 should new indexer have same storage capacity even if we keep same RF/SF=2?

Thanks a lot.

* If this helps, please upvote or accept solution if it solved *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal ,

usually it's better that all Indexers have the same storage capacity because the use the same disk space.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...