topic Re: Can someone help me understand multisite indexer replication? in Deployment Architecture

Can someone help me understand multisite indexer replication?

daniel333 — Tue, 20 Mar 2018 20:08:33 GMT

All,

let's say I have 6 data centers. one is INSANELY small and another very large. How does mutli-site indexer replication handle that? Does it keep a full copy of every data center's data, in every other data center.

That is the Smallest data center would have a copy of all data from the largest?

Re: Can someone help me understand multisite indexer replication?

tiagofbmm — Tue, 29 Sep 2020 18:35:13 GMT

Hey

The MultiSite Clusters have *site replication factor and site search factors *. With that in mind, you can always control how many copies you will have of the data generated in each site with the origin parameter. Furthermore, you can specify how many copies each site has:

site_replication_factor = origin:2, site1:1, site2:1, site3:1, site4:3, site5:1,site6:1 total:9

Imagine your site1 has a new bucket b1, than site1 will have 2 copies of b1, and site2,3,5,6 will have 1 copy and site4 will have 3 copies. This gives a total of 9 copies of a single bucket.

In this particular example, the replication factor explicitly specifies all sites, but that is not a requirement. A non-explicit site is a site that the replication factor does not explicitly specify, and so it may not have bucket copies for all buckets in it, which would be a good scenario for a smaller data center.

So no, you can control that and your smaller site doesn't need to have everything of the larger site.

For full detailed info on this: https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Multisitearchitecture

Re: Can someone help me understand multisite indexer replication?

tiagofbmm — Wed, 21 Mar 2018 17:30:33 GMT

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

Re: Can someone help me understand multisite indexer replication?

oscar84x — Tue, 29 Sep 2020 19:56:18 GMT

This document explains multisite replication in detail:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Sitereplicationfactor

I'm not sure what "Insanely small" means but the amount of peers per site and amount of copies you designate matter as well:

-Each site must deploy a set of peers at least as large as the greater of the origin value or its site value.

For example, given a three-site cluster with "site_replication_factor = origin:2, site1:1, site2:2, site3:3, total:8", the sites must have at least the following number of peers: site1: 2 peers; site2: 2 peers; site3: 3 peers.

-The total number of peers deployed across all sites must be greater than or equal to the total value.