Deployment Architecture

Clarification on SH Cluster replication

pallabtheartist
New Member

I have setup a SH cluster with 5 node the no replication factor (default 3), i am using a single URL to access the SH with Load balancer. i wanted to know since the replication factor is three so the no of copies of knowledge object would be three , what if some one hit the SH which does not have the copy of knowledge object (dashboard , reports etc) , will the user be able to access those knowledge objects.

Tags (1)
0 Karma

Prewin27
New Member

Hi @pallabtheartist ,

The SF and RF is configured on the indexer cluster, which will tell you how many copies of data(buckets) you need to duplicate(RF) and out of that copies how many is searchable(SF).

Knowledge objects created in a search head cluster member replicates to other search head cluster members, which means all the knowledge objects which you have created in a search head will replicate to all the other search head cluster members regardless of your SF and RF settings.

0 Karma

pallabtheartist
New Member

I was asking about the replication factor in Search head cluster , please see the below Splunk docs

https://docs.splunk.com/Documentation/Splunk/8.0.0/DistSearch/ChooseSHCreplicationfactor

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...