topic Re: Multisite Cluster Configuration in Deployment Architecture

Multisite Cluster Configuration

Roger_FB — Wed, 26 Jun 2024 13:24:55 GMT

Hello,
I have the following question:
I would like to set up a multisite cluster with the following structure:

---------

Site 01:
Node01
Index A

Site 02:
Node02
Index B
Index C

Node03
Index D

SearchHead:
Only via Node02 and Node03

Replication:
Index A and B on Node01, Node02, Node03
Index C and D only on Node02 and Node03

Only the replications should be exchanged between Site 01 and Site 02 (no distributed search)

----------------

Is this possible and what do the configs look like (server.conf, indexes.conf etc)?

Have a great day and thank you very much

Re: Multisite Cluster Configuration

gcusello — Wed, 26 Jun 2024 14:22:56 GMT

Hi @Roger_FB ,

at first, this question isn't for the Community but youshould engage a Splunk Architect or a Splunk PS.

Anyway, let me understand:

you have one Indexer on Site1 and two in Site2
indexes on Site2 must be replicated only on Indexers in Site2, instead Indexes in Site1 must be replicated also in Site2.

I'm not sure that's possible to have Indexes not replicated in both the Sites.

Ciao.

Giuseppe

Re: Multisite Cluster Configuration

Roger_FB — Thu, 27 Jun 2024 09:15:05 GMT

Hi Guiseppe,
thanks you for your answer.

Anyway, let me understand:
you have one Indexer on Site1 and two in Site2
indexes on Site2 must be replicated only on Indexers in Site2, instead Indexes in Site1 must be replicated also in Site2.

Yes, that is correct.

Greetings

Roger

Re: Multisite Cluster Configuration

PickleRick — Tue, 02 Jul 2024 07:53:55 GMT

No. You cannot define (site) replication/search factors on a per-index level. You can set an index to being non-replicated but cannot go beyond that.

You set (site)SF/RFs at the server level and only define whether the index is replicated at index level.

So to have a setup with some indexes being replicated between sites and some not you'd need to have separate clusters (I'm not sure however how you go about site-affinity for search-heads when you're connecting to multiple clusters - never tried that).

Re: Multisite Cluster Configuration

gcusello — Tue, 02 Jul 2024 07:56:34 GMT

Hi @Roger_FB ,

as me and @PickleRick said, you cannot configure different replication and search factors for each index, but only one for the entire cluster.

You can only define that there are not replicated indexes.

Ciao.

Giuseppe