Deployment Architecture

Can someone help me understand multisite indexer replication?



let's say I have 6 data centers. one is INSANELY small and another very large. How does mutli-site indexer replication handle that? Does it keep a full copy of every data center's data, in every other data center.

That is the Smallest data center would have a copy of all data from the largest?

0 Karma


This document explains multisite replication in detail:

I'm not sure what "Insanely small" means but the amount of peers per site and amount of copies you designate matter as well:

-Each site must deploy a set of peers at least as large as the greater of the origin value or its site value.

For example, given a three-site cluster with "site_replication_factor = origin:2, site1:1, site2:2, site3:3, total:8", the sites must have at least the following number of peers: site1: 2 peers; site2: 2 peers; site3: 3 peers.

-The total number of peers deployed across all sites must be greater than or equal to the total value.

0 Karma



The MultiSite Clusters have *site replication factor and site search factors *. With that in mind, you can always control how many copies you will have of the data generated in each site with the origin parameter. Furthermore, you can specify how many copies each site has:

site_replication_factor = origin:2, site1:1, site2:1, site3:1, site4:3, site5:1,site6:1 total:9

Imagine your site1 has a new bucket b1, than site1 will have 2 copies of b1, and site2,3,5,6 will have 1 copy and site4 will have 3 copies. This gives a total of 9 copies of a single bucket.

In this particular example, the replication factor explicitly specifies all sites, but that is not a requirement. A non-explicit site is a site that the replication factor does not explicitly specify, and so it may not have bucket copies for all buckets in it, which would be a good scenario for a smaller data center.

So no, you can control that and your smaller site doesn't need to have everything of the larger site.

For full detailed info on this:


Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...