Deployment Architecture

How many IngestionPipelines into single-site distributed environment with 3 indexers ?

sagaraverma
Loves-to-Learn Everything

Environment is single-site with 3 indexers and each indexer with parallelIngestionPipelines = 1(under /opt/splunk/etc/system/default/server.conf).

Does above imply that I have TOTAL "three" ingestion pipelines into my environment (one from each indexer) ?

If yes, with the setting of "maxHotBuckets=10" , would that mean I will have total limit of 30 hot buckets, considering 10 belonging to each ingestion pipeline ?

Labels (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes on the pipelines, yes but per index on the hot buckets.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

| dbinspect can show you how many buckets there are, and what state they are in.

0 Karma

sagaraverma
Loves-to-Learn Everything

Thanks Martin, I got your point.

Now, since I enabled maxHotBuckets to 10 for only one index out of 5 indexes.

Is it possible I can separate and validate Hot buckets count for this one index ? could you help me with some effective query here -
https://answers.splunk.com/answers/820336/how-to-validate-bucket-rotation-retention-paramete.html?mi...

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...