Deployment Architecture

Can I have an indexer cluster on a single logical site, but the actual search peers in different physical network locations?


Hello Splunkers,

We are migrating our Splunk deployment from a single Splunk indexer to an indexer cluster architecture which will be consisting of two peers, and one search head.


Is it possible to create just one indexer cluster "cluster 1" and have the peers in two different network locations in two different countries? Or in that case, do we need multisite clustering?

Based on tests that I've done, it seems to be working and replication is fine, but I am looking for a more experienced answer.

Thanks in advance!


0 Karma


There's no reason this won't work. Even though this is a small cluster, it might make sense to set things up ahead of time with multi-site. This would allow you to expand each site and utilize search affinity if one site becomes the primary for a search head.

What you can do is setup multi-site, then configure your search head to be in "site = site0". This turns off search head site affinity, enabling the search head to search the cluster as if it was one large indexer cluster.

Your configs would look something like this for a RF of 2 and a SF of 1:

server.conf (master node)

site = site1

mode = master
multisite = true
available_sites = site1,site2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:1
pass4SymmKey = <SYMMKEY>
cluster_label = my_awesome_cluster

server.conf (indexer):

site = <SITE>


master_uri = https://<MASTER NODE>:8089
mode = slave
pass4SymmKey = <SYMMKEY>

server.conf (search head):

site = site0

multisite = true
master_uri = https://<MASTER NODE>:8089
mode = searchhead
pass4SymmKey = <SYMMKEY>

As you add more indexers, you can get more specific with where buckets live.
Multi-site clustering docs:

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...