Hi Splunk experts,
We have a 2 site index cluster with 2 indexers per site. The plan is to replace existing disks on the indexers to allocate more space on one indexer at a time. Our current SF and RF setting are below:
multisite=true
available_sites=site1,site2
site_replication_factor = origin:2,total:3
site_search_factor = origin:1,total:2
Current disk utilization:
Site1: indexer1 - 90%,indexer2 - 62%
Site2: indexer1 - 83%,indexer2 - 42%
Question1:
what is the best way to do this activity?
Run the **splunk offline --enforce-counts** on one of the indexers, wait for the data to redistribute, complete the drive upgrades, reinstall splunk and re-add the peer to the cluster. Repeat the same on all the indexers.
Question2:
During this activity, as the replication factor will not be met, does it affect anything?
Question3:
If I bring the indexer1 - 90% offline, will the space on indexer2 - 62% be sufficient to generate the searchable copies?
↧