When a bucket rolls from cold to frozen on a clustered indexer, which of the following scenarios occurs?
When a bucket rolls from cold to frozen on a clustered indexer, which of the following scenarios occurs?
When a bucket rolls from cold to frozen on a clustered indexer, only the bucket on that specific instance is affected. Replicated copies of the bucket will remain on the other indexers until the local retention rule for those indexers also causes them to roll to frozen. The Cluster Master will not trigger any fixup activities, assuming that other indexers will eventually freeze their copies as well. The searchable status of replicated copies depends on the specific cluster's search factor and replication factor settings.
B is correct when a primary copy freezes, the cluster reassigns the primary to another searchable copy, if one exists. Searching then continues on that bucket with the new primary copy. When that primary also freezes, the cluster attempts to reassign the primary yet again to another searchable copy. Once all searchable copies of the bucket have been frozen, searching ceases on that bucket.
No, Cluster master just stops doing fixups on the bucket thinking others indexers will eventually freeze their copies too.
https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Bucketsandclusters Note: In 6.3, a change was made in how the cluster responds to frozen primary bucket copies, in order to prolong the time that a bucket remains available for searching: In a pre-6.3 cluster, when a primary copy freezes, the cluster does not attempt to reassign the primary to any other remaining searchable copy. Searching on a bucket ceases once the primary is frozen. In 6.3 and later, when a primary copy freezes, the cluster reassigns the primary to another searchable copy, if one exists. Searching then continues on that bucket with the new primary copy. When that primary also freezes, the cluster attempts to reassign the primary yet again to another searchable copy. Once all searchable copies of the bucket have been frozen, searching ceases on that bucket.
I think that B is a better answer. It's basically the same as D, with the addition of the point about primary buckets. And that is exactly what happens if the frozen bucket happens to be primary and there happens to be a replicated bucket that is searchable. The question doesn't specifically say the frozen bucket is primary, but that doesn't mean we should ignore the possibility. Answer B is more complete than D.
Sorry, forgot to add the reference: Services Core Implementation notes, page 365
Answer D. Source - page 365 of "Services Core Implementation.pdf"
Slide 365 of Core Implementation
Answer B: Verified by ChatGPT.
D is the correct, if in the question speak about primary bucket, would be B, but it is not the case
Slide 365 of Core Implementation I think that a replicated copy can be searchable and non-searchable depending on the SF/RF settings. We assume there is another searchable copy in the cluster. The SF may be = 1, but not very likely. The last line says: "The only caveat to this is if one of the remaining copies is a searchable copy (and we froze the primary); in this instance, an already-existing searchable copy can be flagged primary (searchable)." I think it's "B"
B. first of all what happens: "[...]The manager then stops doing fix-ups on that bucket. It operates under the assumption that the other peers will eventually freeze their copies of that bucket as well." but(!!) then it will also do this: "In 6.3 and later, when a primary copy freezes, the cluster reassigns the primary to another searchable copy, if one exists. Searching then continues on that bucket with the new primary copy. When that primary also freezes, the cluster attempts to reassign the primary yet again to another searchable copy. Once all searchable copies of the bucket have been frozen, searching ceases on that bucket." so overall B is the most correct answer here. ref: https://docs.splunk.com/Documentation/Splunk/9.1.3/Indexer/Bucketsandclusters#How_the_cluster_handles_frozen_buckets
its D. B is a replicated copy and is not searchable. From the bootcamp slidedeck notes: Individual hosts manage their own retention, but notify master. May trigger fixup activity. One host may have frozen a bucket (perhaps because of uneven disk usage) but others may still have a live copy. If this other copy is live, then the bucket will remain searchable. If only replica copies are available, the data will no longer be searchable. Any bucket frozen in a cluster is only frozen *on that instance*, however, the peer will notify the CM. This is so that no fixup activity is done for that bucket any longer. That is, if a bucket is “missing” because it was frozen, it won’t be replaced. The assumption is that the other indexers will freeze it themselves relatively soon. The only caveat to this is if one of the remaining copies is a searchable copy (and we froze the primary); in this instance, an already-existing searchable copy can be flagged primary (searchable).
I think that a replicated copy can be searchable and non-searchable depending on the SF/RF settings. We assume there is another searchable copy in the cluster. The SF may be = 1, but not very likely. The last line says: "The only caveat to this is if one of the remaining copies is a searchable copy (and we froze the primary); in this instance, an already-existing searchable copy can be flagged primary (searchable)." I think it's "B"
I would say also that D is the correct one. We do not talk about primary bucket.
D is correct answer.