topic Differentiation of indices between nodes in Deployment Architecture

Differentiation of indices between nodes

Semen — Wed, 27 Feb 2019 13:35:21 GMT

What I need to deploy clustered indexes on different nodes. I want to get 3 clusters of 2 nodes each with the ability to search in all clusters from one search head.

Re: Differentiation of indices between nodes

richgalloway — Wed, 27 Feb 2019 13:55:30 GMT

You want a multi-site cluster. See https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Multisitedeploymentoverview.

Re: Differentiation of indices between nodes

Semen — Thu, 28 Feb 2019 05:55:34 GMT

Thanks for the answer.
As far as I understand, in a multisite, data is replicated between sites. I need 3 clusters without replication between the clusters, but with the ability to search on all the clusters with one search head.

Re: Differentiation of indices between nodes

Semen — Thu, 28 Feb 2019 06:00:00 GMT

Re: Differentiation of indices between nodes

richgalloway — Thu, 28 Feb 2019 13:48:12 GMT

It is typical for multi-site clusters to replicate data between sites, but you don't have to do so.

Re: Differentiation of indices between nodes

Semen — Fri, 01 Mar 2019 08:32:19 GMT

What are the index.conf and server.cong settings for this? There is no node selection in the index settings.

Re: Differentiation of indices between nodes

richgalloway — Fri, 01 Mar 2019 13:32:33 GMT

In server.conf, site_replication_factor = origin:2, total:2 will keep all copies in the originating site.

Re: Differentiation of indices between nodes

Semen — Mon, 04 Mar 2019 06:36:22 GMT

If a single node is unavailable in a site, will the index be replicated to a neighboring site? How to avoid it.