3

If this sound silly to you I apologise in advance, I am new to splunk and did udemy course but can't figure out this.

If I check my indexes.conf file in cluster master I get repFator=0
#
# By default none of the indexes are replicated.
#
repFactor = 0

but if I check https://:8089/services/cluster/config

I see replication factor :

replication_factor  2

So I am confused whether my data is getting replicated, I have two indexes in a cluster

ankit singh
  • 111
  • 6

2 Answers2

2

I believe replication_factor determines how many replicas to have amongst nodes in the cluster, and refFactor determines whether or not to replicate a particular index.

For repFactor, which is an index specific setting

The indexes.conf repFactor attribute

When you add a new index stanza, you must set the repFactor attribute to "auto". This causes the index's data to be replicated to other peers in the cluster.

Note: By default, repFactor is set to 0, which means that the index will not be replicated. For clustered indexes, you must set it to "auto".

The only valid values for repFactor are 0 and "auto".

For replication_factor, which is a cluster setting:

Replication factor and cluster resiliency

The cluster can tolerate a failure of (replication factor - 1) peer nodes. For example, to ensure that your system can tolerate a failure of two peers, you must configure a replication factor of 3, which means that the cluster stores three identical copies of each bucket on separate nodes. With a replication factor of 3, you can be certain that all your data will be available if no more than two peer nodes in the cluster fail. With two nodes down, you still have one complete copy of data available on the remaining peers.

By increasing the replication factor, you can tolerate more peer node failures. With a replication factor of 2, you can tolerate just one node failure; with a replication factor of 3, you can tolerate two concurrent failures; and so on.

Mads Hansen
  • 63,927
  • 12
  • 112
  • 147
  • Thank you for your response but I am a bit confused now if : Replication : you must configure a replication factor of 3, which means that the cluster stores three identical copies of each bucket on separate nodes --- My replication factor is 2 so each bucket is getting replicated in another node/peer but RepFactor : repFactor is set to 0, which means that the index will not be replicated -- but all my buckets are getting replicated so shouldn't be repfator more than 0 Please let me know where I am thinking wrong . @Mads-Hansen – ankit singh Dec 03 '21 at 05:16
2

The repFactor setting lets you choose which indexes are replicated. By default, none are. The replication_factor setting says how many copies of a replicated bucket to make. Both must be non-zero to replicate data.

The Cluster Manager should confirm that. Select Settings->Indexer Clustering to see which indexes are replicated and their state.

RichG
  • 9,063
  • 2
  • 18
  • 29
  • I checked Settings->Indexer Clustering and its gives 0 information Cluster Master Searchable Search Factor Replication Factor Status Actions 10.3.58.219:8089 All Data is Searchable Met Met Up Edit Configuration Remove Cluster Generation id 48490 Peers 2 so all I get is the replication factor is met and peers are 2 – ankit singh Dec 03 '21 at 05:16
  • If you're seeing replicated buckets then perhaps you mis-read the config files. Use btool to see what settings are in use: `splunk btool indexes list | grep repFactor` – RichG Dec 03 '21 at 13:17