Deployment Architecture

Can I have an indexer cluster on a single logical site, but the actual search peers in different physical network locations?

evang_26
Communicator

Hello Splunkers,

We are migrating our Splunk deployment from a single Splunk indexer to an indexer cluster architecture which will be consisting of two peers, and one search head.

Question:

Is it possible to create just one indexer cluster "cluster 1" and have the peers in two different network locations in two different countries? Or in that case, do we need multisite clustering?

Based on tests that I've done, it seems to be working and replication is fine, but I am looking for a more experienced answer.

Thanks in advance!

P.

0 Karma

bganem_aplura
Engager

There's no reason this won't work. Even though this is a small cluster, it might make sense to set things up ahead of time with multi-site. This would allow you to expand each site and utilize search affinity if one site becomes the primary for a search head.

What you can do is setup multi-site, then configure your search head to be in "site = site0". This turns off search head site affinity, enabling the search head to search the cluster as if it was one large indexer cluster.

Your configs would look something like this for a RF of 2 and a SF of 1:

server.conf (master node)

[general]
site = site1

[clustering]
mode = master
multisite = true
available_sites = site1,site2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:1
pass4SymmKey = <SYMMKEY>
cluster_label = my_awesome_cluster

server.conf (indexer):

[general]
site = <SITE>

[replication_port://9887]

[clustering]
master_uri = https://<MASTER NODE>:8089
mode = slave
pass4SymmKey = <SYMMKEY>

server.conf (search head):

[general]
site = site0

[clustering]
multisite = true
master_uri = https://<MASTER NODE>:8089
mode = searchhead
pass4SymmKey = <SYMMKEY>

As you add more indexers, you can get more specific with where buckets live.
Multi-site clustering docs: http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Multisiteclusters

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...