Deployment Architecture

In an indexer cluster, if one indexer goes down, will any replicated bucket not be used in search?

brdr
Contributor

We are on Splunk 6.6.2. We presently used indexer clustering. We have 2 indexers. The status of our cluster is:

  • all data is searchable
  • search factor is met
  • replication factor is met

Per Splunk recommendation we use a factor of 2 for both search and replication.

All of our rb_ buckets on disk (on both indexers) have just the rawdata directory. There are no more files in rb_ bucket directory, i.e. no metadata.

If there is no metadata found under the rb_ folders, then it is not really searchable. If 1 indexer goes down then any replicated bucket will not be used by search. Is this true?

0 Karma

skalliger
SplunkTrust
SplunkTrust

Hi,

your my_index/db folder should have folders named db_ as well as rb_. In these bucket folders, metadata are stored in various files. It is not found in a folder like "my_index/db/metadata". There are files like bloomfilter, bucket_info.csv, Strings.data, Sources.data etc.

That's part of your metadata. And with a SF and RF of 2, you will be able to search all of your buckets when only one indexer goes down.

Skalli

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...