Replicated copies of non-searchable data are smaller than copies of searchable data, because they include only the data and not the associated index files. So setting search factor to n-1 has a greater reduction.
TSIDX files are bigger than the raw data, so A is the correct answer.
If you reduce the number of searchable data copies you will have a greater impact on storage savings. We are assuming that the current search_factor=N and replication_factor=N.
IMHO the question is tricky and has a massive 'it depends' in it, but considering N could be any cluster size,
let's assume we have a requirement of 2 searchable copies and a replication factor of 4(=4x raw data distributed accross the nodes total)
and a cluster with 50 peer nodes => so you set it with
A) to 49(!) full sized searchable copies
D) to 49(!) smaller sized raw copies
in contrast "C) Decreasing the data model acceleration range." would actually DECREASE consumed storage
Agreed. The question references N as the number of indexers and specifically calls out ES. Assuming the RF and SF are initially the defaults of 3:2 respectively (without other info, I revert to that) the ONLY case where A and D do not increase the disk space is if N<3. All other cases will significantly increase the disk requirements. The only option guaranteed to reduce disk is to shrink the size of the accelerations. Make your own determination, but I will be selecting C if I am presented with this question.
Replication factor (RF) is the number of copies of a bucket. Search factor (SF) is the number of those copies which are searchable. You can't search more copies than you have so SF must be less than or equal to RF. By reducing RF to N-1 you are automatically reducing the SF to N-1. So answer is D.
Architecting Splunk Enterprise Deployments, "Best Practice: Minimum (RF +1) peer nodes. You have a replication factor of 3, then you want 4 peer nodes, not one less.
Seems the question assumes SF is always smaller than RF, while RF in example in
https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Systemrequirements equal to cluster size, e.g.
3 peer nodes, with replication factor = 3; search factor = 2
5 peer nodes, with replication factor = 5; search factor = 3
In these cases, setting SF=N-1 will increase disk usage instead, while since RF=N in both cases, setting RF=N-1 will reduce disk usage.
Is that why having answer = D ?
Answer A seems correct as Replicated copies of non-searchable data are smaller than copies of searchable data, because they include only the data and not the associated index files.
Answer A seems correct as Replicated copies of non-searchable data are smaller than copies of searchable data, because they include only the data and not the associated index files.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Crash_Override
Highly Voted 3 years, 3 months ago62d8e4c
Most Recent 9 months, 2 weeks agobobixaka
1 year, 4 months agoFreshLearn
1 year, 4 months agodurmindin
2 weeks, 1 day ago_bert
1 year, 9 months agoSledge_Hammer
2 years agoHarllen91
2 years agostwong
2 years, 6 months agojavo_dlg
2 years, 8 months agoSplunkStreamer
2 years, 9 months agofrappe
2 years, 10 months agoRedYeti
3 years, 1 month agomanu78
4 years, 2 months agosunil299
4 years, 4 months ago