topic multi-site cluster replication in Deployment Architecture

multi-site cluster replication

hazem — Mon, 10 Jun 2024 07:02:46 GMT

-in multi-site cluster if initially, the replication factor was

site_replication_factor = origin:2,total:2

site_search_factor =origin:1,total:1

and later I change it to

site_replication_factor = origin:2,total:3

site_search_factor =origin:1,total:2

Will the old data also be replicated with new replication and search factor Or only the new data will have the replication copies as per new replication and search factors

Re: multi-site cluster replication

gcusello — Mon, 10 Jun 2024 10:31:18 GMT

Hi @hazem ,

I hint to follow the Splunk Cluster Administration training.

Otherwise, did you followed the steps at https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Migratetomultisite ?

so try with

constrain_singlesite_buckets = false

Ciao.

Giuseppe

Re: multi-site cluster replication

hazem — Mon, 10 Jun 2024 11:10:46 GMT

HI @gcusello

what will this command do?

We have been running our indexer cluster as a multisite cluster with 3 indexers in our main site for the past year. With the below configuration:

site_replication_factor = origin:2,total:2

site_search_factor = origin:1,total:1

now we have decided to establish a disaster recovery site with an additional 3 indexers.

The expected configuration for the new DR site will be as follows:

site_replication_factor = origin:2, total:3

site_search_factor = origin:1, total:2

will the replication process start syncing all logs in the hot, warm and cold buckets (approximately 20TB ) to DR indexers or will start real-time hot logs only??

Re: multi-site cluster replication

gcusello — Mon, 10 Jun 2024 11:18:07 GMT

Hi @hazem ,

did you read https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Migratetomultisite#How_the_cluster_migrates_and_maintains_existing_buckets ?

especially "If you have a large number of existing buckets, the process can take a long time to complete".

Anyway, migration from single site to multisite is a job for a Certified Splunk Architect, not for the Community.

Ciao.

Giuseppe