Cluster master in the cloud?

[jeremyhagand61]

Consider a two data centre environment with good connectivity between (sub 5ms latency and multiple 40mbps links) and I want to implement search or index clusters to achieve cross site HA

However, without a node at a third site I get limited usefulness when data centre goes dark. If I situate the third node on either side there is a 50/50 chance that I wont end up with true HA.

However, I could put the Cluster master/captain in an Azure/AWS VM. If this supported? I imagine the latency between either data centre and the Cloud VM would be as much as 100ms.

Is this supported? Has anyone done this?

[brendanmacooper]

Hi Jeremy,

The Splunk Validated Architectures document is great place to start with these kind of questions. If you truly need full HA between DCs you might need a multi-site cluster. This will allow you to specify how many copies of the data you want to keep in each site (DC). In the SVA, the examples start with 'M'.

That being said doing multi-site cluster with only 3 indexers is overkill so I'd question whether you truly need it. A normal clustered environment might better suit your requirements if you can accept the risk.