Can someone help me understand multisite indexer replication?

[daniel333]

All,

let's say I have 6 data centers. one is INSANELY small and another very large. How does mutli-site indexer replication handle that? Does it keep a full copy of every data center's data, in every other data center.

That is the Smallest data center would have a copy of all data from the largest?

[oscar84x]

This document explains multisite replication in detail:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Sitereplicationfactor

I'm not sure what "Insanely small" means but the amount of peers per site and amount of copies you designate matter as well:

-Each site must deploy a set of peers at least as large as the greater of the origin value or its site value.

For example, given a three-site cluster with "site_replication_factor = origin:2, site1:1, site2:2, site3:3, total:8", the sites must have at least the following number of peers: site1: 2 peers; site2: 2 peers; site3: 3 peers.

-The total number of peers deployed across all sites must be greater than or equal to the total value.

[tiagofbmm]

Hey

The MultiSite Clusters have *site replication factor and site search factors *. With that in mind, you can always control how many copies you will have of the data generated in each site with the origin parameter. Furthermore, you can specify how many copies each site has:

site_replication_factor = origin:2, site1:1, site2:1, site3:1, site4:3, site5:1,site6:1 total:9

Imagine your site1 has a new bucket b1, than site1 will have 2 copies of b1, and site2,3,5,6 will have 1 copy and site4 will have 3 copies. This gives a total of 9 copies of a single bucket.

In this particular example, the replication factor explicitly specifies all sites, but that is not a requirement. A non-explicit site is a site that the replication factor does not explicitly specify, and so it may not have bucket copies for all buckets in it, which would be a good scenario for a smaller data center.

So no, you can control that and your smaller site doesn't need to have everything of the larger site.

For full detailed info on this: https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Multisitearchitecture

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that