Choose the replication factor for the search head cluster

The replication factor determines the number of copies of each search artifact, or search result, that the cluster maintains. Replication occurs only for artifacts from scheduled saved searches. The cluster does not replicate results from ad hoc searches or realtime searches.

Effect of the replication factor

The cluster can tolerate a failure of (replication factor - 1) members without losing any search artifacts. For example, to ensure that your system can handle the failure of two members without losing search artifacts, configure a replication factor of 3. This configuration directs the cluster to store three copies of each search artifact, with each copy on a different member. If two members go down, the artifact is still available on a third member.

The default value for the replication factor is 3. This number is sufficient for most purposes.

Even with a large cluster of, for example, 50 search heads, you do not need a commensurately large replication factor. As long as you do not lose the replication factor number of members, at least one copy of each search artifact still exists somewhere on the cluster and is accessible to all cluster members. Any search head in the cluster can access any search artifact by proxying from a search head storing a copy of that artifact. The proxying operation is fast and unlikely to impede access to search results from any search head.

Note: The replication factor determines only the number of copies of search artifacts that the cluster maintains. It does not affect the replication of runtime configuration changes, such as new saved searches. Those changes get replicated to all cluster members by a different process. If you have 50 search heads, each of those 50 gets a copy of such configuration changes. See Configuration updates that the cluster replicates.

Replication factor configuration

All search head cluster members must use the same replication factor. The server.conf attribute that determines the replication factor is replication_factor in the [shclustering] stanza.

You specify the replication factor during deployment of the cluster, as part of member initialization. See Initialize cluster members.

You can change the replication factor post-deployment, if necessary, but it is recommended that you consult Splunk Support before doing so. If you change the replication factor on one member, you must change it on all members. For information on modifying configuration values, see Configure the search head cluster.

For more information

For information on how the cluster replicates search artifacts, see How the cluster handles search artifacts. That subtopic describes several key points about artifact replication, among them:

• In some cases, the cluster might replicate more than the replication factor number of a search artifact.
• Artifact proxying, along with additional replication, occurs if a member without a copy of the artifact needs access to it.
• If a member goes down, the cluster replaces the artifact copies that were being stored on that member.

See List search artifacts to learn how to view the set of artifacts in the cluster and on individual members.