I wanted to change the RF and SF to 2 and 2. I see an edit button on the cluster master > indexer cluster next to the RF and SF values. Can u plz confirm that changing the RF /SF is as simple as changing the value on from the cluster master GUI?
I tried searching Splunk answers but didn't find anything concrete.
So any link to a doc would be appreciated.
I just need confirmation that simply changing the value on the cluster master will do the trick and no additional steps are required.
I understand that older data will not be deleted immediately.
yes, it'll require a Cluster Master restart (the UI should then prompt you to restart)