Best practices and limitations for indexing and replication separation

Follow these best practices when you roll out Indexing and Replication Separation, and review the known limitations before you deploy to production.

Configuration best practices

  • Roll out the feature in a lower environment before you enable it in production.
  • Validate at least one representative SmartStore-enabled index before a broad rollout.
  • Enable the feature consistently across intended indexes to avoid mixed behavior.
  • Verify source indexer, cluster manager, and target indexer logs after each rollout.
  • Validate only after the cluster is healthy and stable.

Suggested rollout checklist

  1. Confirm that the Splunk Enterprise version is supported.
  2. Confirm that Ingest-Tier Scaling is already enabled and stable.
  3. Confirm that SmartStore is enabled for each target index.
  4. Add the required settings to the cluster manager bundle.
  5. Push the cluster bundle.
  6. Wait until the cluster is healthy.
  7. Generate or ingest test data into a configured index.
  8. Verify source indexer logs.
  9. Verify cluster manager logs.
  10. Verify target indexer logs.
  11. Expand the rollout only after the initial validation passes.

Disaster recovery considerations

Before you use Indexing and Replication Separation in production, review how your deployment handles recovery scenarios. In particular, confirm the following:

  • SmartStore remote storage is configured and recoverable for each participating index.
  • Replication factor, search factor, and site settings meet the documented requirements.
  • Restore procedures are tested outside the feature rollout path.
  • Operational teams understand which recovery behavior Splunk handles and which procedures remain customer-managed.

Limitations

  • This feature is constrained by SmartStore behavior and SmartStore limitations.
  • The feature is intended for a single S3 region. Multiple Availability Zones within that region are supported.
  • For single-site clusters, the replication factor (RF) must be greater than 1.
  • For single-site clusters, the search factor (SF) must equal the RF.
  • For multisite indexer clusters, configure the RF to equal the site count and maintain one copy in each site.