Splunk : How to figure out replication Factor

Viewed 524

If this sound silly to you I apologise in advance, I am new to splunk and did udemy course but can't figure out this.

If I check my indexes.conf file in cluster master I get repFator=0
#
# By default none of the indexes are replicated.
#
repFactor = 0

but if I check https://:8089/services/cluster/config

I see replication factor :

replication_factor  2

So I am confused whether my data is getting replicated, I have two indexes in a cluster

2 Answers

I believe replication_factor determines how many replicas to have amongst nodes in the cluster, and refFactor determines whether or not to replicate a particular index.

For repFactor, which is an index specific setting

The indexes.conf repFactor attribute

When you add a new index stanza, you must set the repFactor attribute to "auto". This causes the index's data to be replicated to other peers in the cluster.

Note: By default, repFactor is set to 0, which means that the index will not be replicated. For clustered indexes, you must set it to "auto".

The only valid values for repFactor are 0 and "auto".

For replication_factor, which is a cluster setting:

Replication factor and cluster resiliency

The cluster can tolerate a failure of (replication factor - 1) peer nodes. For example, to ensure that your system can tolerate a failure of two peers, you must configure a replication factor of 3, which means that the cluster stores three identical copies of each bucket on separate nodes. With a replication factor of 3, you can be certain that all your data will be available if no more than two peer nodes in the cluster fail. With two nodes down, you still have one complete copy of data available on the remaining peers.

By increasing the replication factor, you can tolerate more peer node failures. With a replication factor of 2, you can tolerate just one node failure; with a replication factor of 3, you can tolerate two concurrent failures; and so on.

The repFactor setting lets you choose which indexes are replicated. By default, none are. The replication_factor setting says how many copies of a replicated bucket to make. Both must be non-zero to replicate data.

The Cluster Manager should confirm that. Select Settings->Indexer Clustering to see which indexes are replicated and their state.

Related