We are on Splunk 6.6.2. We presently used indexer clustering. We have 2 indexers. The status of our cluster is:
Per Splunk recommendation we use a factor of 2 for both search and replication.
All of our rb_ buckets on disk (on both indexers) have just the rawdata directory. There are no more files in rb_ bucket directory, i.e. no metadata.
If there is no metadata found under the rb_ folders, then it is not really searchable. If 1 indexer goes down then any replicated bucket will not be used by search. Is this true?
Hi,
your my_index/db folder should have folders named db_ as well as rb_. In these bucket folders, metadata are stored in various files. It is not found in a folder like "my_index/db/metadata". There are files like bloomfilter, bucket_info.csv, Strings.data, Sources.data etc.
That's part of your metadata. And with a SF and RF of 2, you will be able to search all of your buckets when only one indexer goes down.
Skalli