https://community.splunk.com/t5/Deployment-Architecture/What-is-origin-when-setting-a-Multisite-Indexer-Cluster/m-p/402356#M14524 <P>The 'origin' refers to the site which contains the original raw data (bucket). The term <CODE>-site_replication_factor origin:1,total:2</CODE> means that there will be 1 copy of raw data bucket in the site where data was originated (indexed) (1 copy means just the original copy) and there will be a total of 2 copied of that data available in the cluster (so since origin site has 1, other 1 copy (2-1=1) will be replicated to other site(s)).</P> Mon, 08 Apr 2019 19:48:58 GMT somesoni2 2019-04-08T19:48:58Z https://community.splunk.com/t5/Deployment-Architecture/What-is-origin-when-setting-a-Multisite-Indexer-Cluster/m-p/402355#M14523 <P>What is origin? I just don't understand what it means...</P> <P>As in the command - </P> <PRE><CODE>~/cmaster/bin/splunk edit cluster-config -mode master -multisite true -site site1 -available_sites site1,site2 -site_replication_factor origin:1,total:2 -site_search_factor origin:1,total:2 -replication_factor 1 -search_factor 1 -secret xxxx </CODE></PRE> Mon, 08 Apr 2019 19:36:41 GMT https://community.splunk.com/t5/Deployment-Architecture/What-is-origin-when-setting-a-Multisite-Indexer-Cluster/m-p/402355#M14523 ddrillic 2019-04-08T19:36:41Z https://community.splunk.com/t5/Deployment-Architecture/What-is-origin-when-setting-a-Multisite-Indexer-Cluster/m-p/402356#M14524 <P>The 'origin' refers to the site which contains the original raw data (bucket). The term <CODE>-site_replication_factor origin:1,total:2</CODE> means that there will be 1 copy of raw data bucket in the site where data was originated (indexed) (1 copy means just the original copy) and there will be a total of 2 copied of that data available in the cluster (so since origin site has 1, other 1 copy (2-1=1) will be replicated to other site(s)).</P> Mon, 08 Apr 2019 19:48:58 GMT https://community.splunk.com/t5/Deployment-Architecture/What-is-origin-when-setting-a-Multisite-Indexer-Cluster/m-p/402356#M14524 somesoni2 2019-04-08T19:48:58Z https://community.splunk.com/t5/Deployment-Architecture/What-is-origin-when-setting-a-Multisite-Indexer-Cluster/m-p/402357#M14525 <P>Crystal clear as always - thank you @somesoni2 !!!</P> Mon, 08 Apr 2019 22:09:45 GMT https://community.splunk.com/t5/Deployment-Architecture/What-is-origin-when-setting-a-Multisite-Indexer-Cluster/m-p/402357#M14525 ddrillic 2019-04-08T22:09:45Z https://community.splunk.com/t5/Deployment-Architecture/What-is-origin-when-setting-a-Multisite-Indexer-Cluster/m-p/402358#M14526 <P>A related question at <A href="https://answers.splunk.com/answers/754248/whats-the-relation-between-the-site-replication-fa-1.html?minQuestionBodyLength=80" target="_blank">What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?</A></P> Wed, 30 Sep 2020 01:01:58 GMT https://community.splunk.com/t5/Deployment-Architecture/What-is-origin-when-setting-a-Multisite-Indexer-Cluster/m-p/402358#M14526 ddrillic 2020-09-30T01:01:58Z