![]() ![]() It is inadvisable to increase the replication factor after the cluster contains a significant amount of data. Warning: Make sure you start by choosing the right replication factor for your needs. ![]() For more information, see "Replication factor". For multisite clusters, you also need to decide how many copies to put on each site. But it also means that you will need more nodes and more storage to handle the additional data. A higher replication factor means that more copies of the data will reside on more peer nodes, so your cluster can tolerate more node failures without loss of data availability. Your optimal replication factor depends on factors specific to your environment, but essentially involves a trade-off between failure tolerance and storage capacity. The replication factor is the number of copies of raw data that the cluster maintains. Decide what replication factor you want to implement. For more information, read "Multisite indexer clusters".Ĭ. They also enable search affinity, which reduces network traffic by limiting searches to local data. Multisite clusters offer strong disaster recovery capabilities because they allow you to distribute copies of your data across multiple locations. Determine whether you will be deploying a basic, single-site cluster or a multisite cluster. Understand your data availability and failover needs. These are the key steps in deploying clusters:Ī. Here is a diagram of a small cluster, showing the various nodes that you deploy: In addition, you usually set up forwarders to send data to the cluster. You also enable a search head to search data in the cluster. When you deploy a cluster, you enable and configure the cluster manager node and the peer nodes that perform the indexing. If you are deploying a multisite cluster, read this topic first and then read "Multisite indexer cluster deployment overview". Deploying them requires that you consider some additional issues and perform an entirely different set of configurations. Multisite indexer clusters are considerably more complex than single-site clusters. There is no supported procedure for converting an indexer from clustered to non-clustered. Important: Before migrating an indexer from non-clustered to clustered, be certain of your needs. After you read that material, go to "Migrate non-clustered indexers to a clustered environment" for the actual migration process. See "Key differences between clustered and non-clustered deployments of indexers". It is important that you be aware of these issues before you migrate your indexers. Migrating from a non-clustered Splunk Enterprise deployment?Ĭlustered indexers (peers) have several different requirements from non-clustered indexers. For information on how to incorporate search heads that are members of a search head cluster, see "Integrate the search head cluster with an indexer cluster" in the Distributed Search manual. Important: This chapter assumes that you are deploying independent search heads in the indexer cluster. See "Use forwarders" in the Getting Data In manual. How to use a forwarder to get data into an indexer.For information on the differences see "Search head configuration overview" in this manual. Note, however, that you configure search heads for indexer clusters somewhat differently from other search heads. For an introduction to distributed search, see "About distributed search" in the Distributed Search manual. In particular, see "How the indexer stores indexes", along with the other topics in this manual that describe managing indexes. Subsequent topics describe these steps in detail.īefore you attempt to deploy a cluster, you must be familiar with several areas of Splunk Enterprise administration: This topic describes the main steps to deploying indexer clusters. ![]()
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |