topic Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor." in Deployment Architecture

multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

brent_weaver — Mon, 05 Aug 2019 12:00:43 GMT

I am configuring a multisite cluster and am confused by this error message. I have 2 sites and 4 nodes. The error message does not make sense. "total should be greater than or equal to replication_factor." Any help is MUCH appreciated.

splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:1,total:2 -site_search_factor origin:1,total:1
Your session is invalid.  Please login.
Splunk username: brent
Password:
Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor.

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

kartm2020 — Wed, 30 Sep 2020 01:36:04 GMT

Can you please try the below command
splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:2,total:3 -site_search_factor origin:1,total:2

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

brent_weaver — Mon, 05 Aug 2019 13:22:58 GMT

Thanks for the response, i already did that and it worked. But to me that seems that I will have a two coopes on origin, is that not the case?

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

kartm2020 — Mon, 05 Aug 2019 13:41:30 GMT

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/MultisiteCLI

When comes to the multisite cluster. You have to go with the default value and you cant reduce it. but you can increase it.

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

brent_weaver — Mon, 05 Aug 2019 13:49:32 GMT

When you say "the default value" what do you mean. This has always confused me about splunk. I would assume origin:1,total:2 would leave one bucket on origin and copy another to the other site. Is this NOT the case?

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

kartm2020 — Wed, 30 Sep 2020 01:36:15 GMT

From your command it says total is 2. But your replication factor is 3. Replication factor is different from site replication factor.
The site_replication_factor replaces the standard replication_factor used with single-site clusters.
So it is not taking. If you have 3 nodes in your environment then it might get work.
If you are not setting any rep factor. by default it will take as origin:2,total:3.
Hope i have answered your question. Please let me know for more clarification.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitereplicationfactor

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

brent_weaver — Mon, 05 Aug 2019 14:58:52 GMT

So lets try it this way. I have a 2 site cluster, 2 nodes in site one and two nodes in site two. I want one bucket to go to one site, and another to go to the other site. Will this config accomplish that?

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

kartm2020 — Tue, 06 Aug 2019 03:29:41 GMT

No it wont. Because you have 4 nodes with rep factor of 3. total should always greater than or equal to rep factor. In your command you have written the total as 2. thats the reason it showing an error "total should be greater than or equal to replication_factor"

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

brent_weaver — Tue, 06 Aug 2019 13:22:25 GMT

Ok so what am I missing here? How do I put one bucket on origin and one on the other site?

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

kartm2020 — Thu, 08 Aug 2019 04:49:51 GMT

Sorry for the late response. You are putting total as 3. Can you please put origin as 1 and total as 4. It might get work. Please let me know about the status.

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

kartm2020 — Tue, 13 Aug 2019 04:46:52 GMT

Hope I answered your question.

Re: multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

saravanan90 — Wed, 30 Sep 2020 04:23:38 GMT

Run the below command & update the replication_factor, site_replication_factor manually in server.conf as below.

splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:2,total:3 -site_search_factor origin:1,total:2

[clustering]
mode = master
multisite = true
available_sites = site1,site2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:2
replication_factor = 2

Refer the below link.
https://answers.splunk.com/answers/294071/indexer-cluster-error-site-replication-factor-orig.html