Scenario-based Splunk Admin Use Case 3

09.07.24 07:43 PM - By Murugan

What happens, If two of the Indexers down in 3-member cluster?

    • Some of the searches will give incomplete results. once all the bucket copies in the last indexer are made searchable, then searches can give complete results
    • Some of the searches will give incomplete results, as 2 of the Indexers, with primary copies of some of the buckets are down.
    • The Cluster master will instruct the last remaining peer to make the copies of all available buckets as searchable ones, also make them as primary copies(This includes creating the index files from the raw data).

Murugan