Greetings!
We are using S.O.S. to debug our cluster. Right now in SOS, on the cluster master view, it is showing
Replication Factor: 3
Search Factor: 1
However, on our Cluster Master, we have set
Replication Factor: 2
Search Factor: 2
Here is the output from ./splunk list cluster-peers
24002090-5EDB-44D6-B99D-E95C3FF27BFD
active_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
base_generation_id:205
bucket_count:5370
delayed_buckets_to_discard:
fixup_set:
heartbeat_started:1
host_port_pair:172.22.77.162:8089
is_searchable:1
label:ii-splunk-peer1
last_heartbeat:1428069707
latest_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
pending_job_count:0
primary_count:3167
primary_count_remote:0
replication_count:0
replication_port:9887
replication_use_ssl:0
site:default
status:Up
3E8F7683-A2C7-4C79-A1B2-B8765E7325E6
active_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
base_generation_id:210
bucket_count:4753
delayed_buckets_to_discard:
fixup_set:
heartbeat_started:1
host_port_pair:172.22.77.164:8089
is_searchable:1
label:ii-splunk-peer3
last_heartbeat:1428069707
latest_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
pending_job_count:0
primary_count:87
primary_count_remote:0
replication_count:0
replication_port:9887
replication_use_ssl:0
site:default
status:Up
58478145-DA96-4B4E-8C2E-69429BD38BDB
active_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
base_generation_id:207
bucket_count:4888
delayed_buckets_to_discard:
fixup_set:
heartbeat_started:1
host_port_pair:172.22.77.163:8089
is_searchable:1
label:ii-splunk-peer2
last_heartbeat:1428069707
latest_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
pending_job_count:0
primary_count:3159
primary_count_remote:0
replication_count:0
replication_port:9887
replication_use_ssl:0
site:default
status:Up
F31ECF68-62CA-4639-9CD2-5F00465BD4C9
active_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
base_generation_id:204
bucket_count:4759
delayed_buckets_to_discard:
fixup_set:
heartbeat_started:1
host_port_pair:172.22.77.165:8089
is_searchable:1
label:ii-splunk-peer4
last_heartbeat:1428069707
latest_bundle_id:368A8C1EB162A17383C34C9EBE25E3E2
pending_job_count:0
primary_count:3174
primary_count_remote:0
replication_count:0
replication_port:9887
replication_use_ssl:0
site:default
status:Up
Here is the output from ./splunk list search-server
Server at URI "172.22.77.162:8089" with status as "Up"
Server at URI "172.22.77.163:8089" with status as "Up"
Server at URI "172.22.77.164:8089" with status as "Up"
Server at URI "172.22.77.165:8089" with status as "Up"
Any ideas on why the Search factor is not met or how I can further troubleshoot why the Search factor is not met would be greatly appreciated.
Thank you
Jeffrey
i'd start with looking at which buckets are not meeting SF, and their states.
go to the cluster master buckets endpoint:
https://master-uri:mgmt-port/services/cluster/master/buckets?filter=search_count<2&filter=frozen=fal...
if nothing shows up there, check out
https://master-uri:mgmt-port/services/cluster/master/buckets?filter=search_state=PendingSearchable
to see if any buckets are currently being made searchable (so as to meet SF)
Hi,
How many members have you in your cluster?
Firstly, the value of Replication Factor must be lower or equal to the number of your cluster members
secondly, make sure that the values of attributes (Replication Factor and Search Factor) in SOS app are less than attributes (Replication Factor and Search Factor) in your deployment