Can I have an indexer cluster on a single logical site, but the actual search peers in different physical network locations?

[evang_26]

Hello Splunkers,

We are migrating our Splunk deployment from a single Splunk indexer to an indexer cluster architecture which will be consisting of two peers, and one search head.

Question:

Is it possible to create just one indexer cluster "cluster 1" and have the peers in two different network locations in two different countries? Or in that case, do we need multisite clustering?

Based on tests that I've done, it seems to be working and replication is fine, but I am looking for a more experienced answer.

Thanks in advance!

P.

[bganem_aplura]

There's no reason this won't work. Even though this is a small cluster, it might make sense to set things up ahead of time with multi-site. This would allow you to expand each site and utilize search affinity if one site becomes the primary for a search head.

What you can do is setup multi-site, then configure your search head to be in "site = site0". This turns off search head site affinity, enabling the search head to search the cluster as if it was one large indexer cluster.

Your configs would look something like this for a RF of 2 and a SF of 1:

server.conf (master node)

[general]
site = site1

[clustering]
mode = master
multisite = true
available_sites = site1,site2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:1
pass4SymmKey = <SYMMKEY>
cluster_label = my_awesome_cluster

server.conf (indexer):

[general]
site = <SITE>

[replication_port://9887]

[clustering]
master_uri = https://<MASTER NODE>:8089
mode = slave
pass4SymmKey = <SYMMKEY>

server.conf (search head):

[general]
site = site0

[clustering]
multisite = true
master_uri = https://<MASTER NODE>:8089
mode = searchhead
pass4SymmKey = <SYMMKEY>

As you add more indexers, you can get more specific with where buckets live.
Multi-site clustering docs: http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Multisiteclusters