Deployment Architecture

If I have a replication factor of 3, when data rolls to frozen, will it store 3 copies of the same frozen bucket?

jordanperks
Path Finder

I have been searching for hours and have, so far, come up empty. If I have a RF=3 and SF=3, when data rolls to my frozen archive, will it store 3 copies of the same frozen bucket? Also, what does that compression look like? The 0.15 that is average RF or the 0.15+0.35 for the SF?

0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

I think this might be what you are looking for: How the cluster handles frozen buckets, in the Managing Indexers and Clusters of Indexers manual.

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

I think this might be what you are looking for: How the cluster handles frozen buckets, in the Managing Indexers and Clusters of Indexers manual.

jordanperks
Path Finder

Sorry changed jobs and had to create a new account so I created the miront account.

0 Karma

miront
Explorer

http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Automatearchiving

This had the info I was looking for. Your link got me there though. Thanks ChrisG!

Indexer clusters contain redundant copies of indexed data. If you archive that data using the techniques described above, you archive multiple copies of the data.

For example, if you have a cluster with a replication factor of 3, the cluster stores three copies of all its data across its set of peer nodes. If you set up each peer node to archive its own data when it rolls to frozen, you end up with three archived copies of the data. You cannot solve this problem by archiving just the data on a single node, since there's no certainty that a single node contains all the data in the cluster.

The solution to this would be to archive just one copy of each bucket on the cluster and discard the rest. However, in practice, it is quite a complex matter to do that. If you want guidance in archiving single copies of clustered data, contact Splunk Professional Services. They can help design a solution customized to the needs of your environment.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...