Indexer Clustering
Topology
An indexer cluster has one cluster manager (historically the master), several peer indexers, and search heads pointed at the cluster. Peers hold replicated buckets; the manager coordinates replication, bucket fixup, and priming. Configure through server.conf [clustering]: mode = manager|peer|searchhead, manager_uri, cluster_label, pass4SymmKey, and replication_port (default 9887). Peer app and index configuration is distributed from the manager's manager-apps directory.
Replication and search factors
Replication factor (RF) is the total number of copies of each bucket; search factor (SF) is the number of those copies that are searchable. Defaults are RF=3 and SF=2. Constraints: SF must be less than or equal to RF, and RF cannot exceed the number of peers. repFactor = auto in an index stanza on a peer means the cluster default. Multisite clusters add site_replication_factor and site_search_factor.
Operations
Peer states (Up, Pending), bucket states (complete, fixup in progress), splunk show cluster-status, maintenance mode, and rolling restarts. Removing or losing a peer can take buckets below RF; let fixup finish before further changes.
Traps
- Treating the cluster manager as a data node or search head - it does not index.
- Setting RF above the peer count, or SF greater than RF.
- Pushing peer configuration from a deployment server instead of the manager's
manager-apps. - Expecting instant searchability after a peer returns; searchable copies must be rebuilt.
Rule of thumb
Design around RF first: with RF=3 and SF=2 you can lose one peer with no data loss and still search; keep peer counts odd and RF at or below peers minus one for clean failure tolerance.