Deployment Architecture

How many IngestionPipelines into single-site distributed environment with 3 indexers ?

sagaraverma
Loves-to-Learn Everything

Environment is single-site with 3 indexers and each indexer with parallelIngestionPipelines = 1(under /opt/splunk/etc/system/default/server.conf).

Does above imply that I have TOTAL "three" ingestion pipelines into my environment (one from each indexer) ?

If yes, with the setting of "maxHotBuckets=10" , would that mean I will have total limit of 30 hot buckets, considering 10 belonging to each ingestion pipeline ?

Labels (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes on the pipelines, yes but per index on the hot buckets.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

| dbinspect can show you how many buckets there are, and what state they are in.

0 Karma

sagaraverma
Loves-to-Learn Everything

Thanks Martin, I got your point.

Now, since I enabled maxHotBuckets to 10 for only one index out of 5 indexes.

Is it possible I can separate and validate Hot buckets count for this one index ? could you help me with some effective query here -
https://answers.splunk.com/answers/820336/how-to-validate-bucket-rotation-retention-paramete.html?mi...

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...