We preparing to move from a single indexer to an index cluster. I'm trying to determine the performance implications of a two node index cluster with the replication factor set to two and the search factor also set to two?
In the documentation manual "Managing Indexers and Clusters of Indexers" doc, under the section "How indexer clusters work", the subsection "Buckets and indexer clusters"
https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Bucketsandclusters
under the heading Data files it states:
"If the cluster has a search factor greater than 1, some or all of the target peers also create index files for the data. For example, say you have a replication factor of 3 and a search factor of 2. In that case, the source peer streams its raw data to two target peers. One of those peers then uses the raw data to create index files, which it stores in its copy of the bucket. That way, there will be two searchable copies of the data (the original copy and the replicated copy with the index files)."
I’m reading that as only the raw data is replicated, not the index files. The index files are recreated on the peer. So in a two node cluster with replication factor of 2 and a search factor of 2 both nodes would always be indexing the data.
... View more
