Deployment Architecture

Cluster master in the cloud?


Consider a two data centre environment with good connectivity between (sub 5ms latency and multiple 40mbps links) and I want to implement search or index clusters to achieve cross site HA

However, without a node at a third site I get limited usefulness when data centre goes dark. If I situate the third node on either side there is a 50/50 chance that I wont end up with true HA.

However, I could put the Cluster master/captain in an Azure/AWS VM. If this supported? I imagine the latency between either data centre and the Cloud VM would be as much as 100ms.

Is this supported? Has anyone done this?

0 Karma


Hi Jeremy,

The Splunk Validated Architectures document is great place to start with these kind of questions. If you truly need full HA between DCs you might need a multi-site cluster. This will allow you to specify how many copies of the data you want to keep in each site (DC). In the SVA, the examples start with 'M'.

That being said doing multi-site cluster with only 3 indexers is overkill so I'd question whether you truly need it. A normal clustered environment might better suit your requirements if you can accept the risk.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...