- Splunk 7.x Quick Start Guide
- James H. Baxter
- 245字
- 2021-06-10 19:04:55
Search factor
When you configure the cluster master node to specify the replication factor, you also designate a search factor. The search factor determines the number of searchable copies of data the indexing cluster maintains. The default value for a search factor is 2, meaning that the cluster maintains two searchable copies of all the data buckets. The search factor must be less than or equal to the replication factor.
The difference between a searchable and a non-searchable copy of a data bucket is that the searchable copies include both the raw data itself and the index files the indexer uses to search the data; a non-searchable copy just contains the raw data alone. Data stored as a non-searchable copy is saved in a form that makes it possible to recreate the index files later, if necessary, but the data won't be immediately searchable otherwise.
The trade-off with the search factor setting is that keeping searchable copies of data takes more disk storage than non-searchable data. The default search factor of 2 is sufficient for most situations, keeping in mind that, if a single node goes down, the cluster master works quickly to create and redistribute searchable copies elsewhere in the cluster.
In summary, the replication factor simply represents the number of copies of the raw data maintained across the indexing tier, and the search factor represents the number of copies of the index files used for searching that data that is maintained.