Differentiation of indices between nodes

[Semen]

What I need to deploy clustered indexes on different nodes. I want to get 3 clusters of 2 nodes each with the ability to search in all clusters from one search head.

[richgalloway · Accepted solution]

You want a multi-site cluster. See https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Multisitedeploymentoverview.

[Semen]

Thanks for the answer.
As far as I understand, in a multisite, data is replicated between sites. I need 3 clusters without replication between the clusters, but with the ability to search on all the clusters with one search head.

[richgalloway]

It is typical for multi-site clusters to replicate data between sites, but you don't have to do so.

[Semen]

What are the index.conf and server.cong settings for this? There is no node selection in the index settings.

[richgalloway]

In server.conf, site_replication_factor = origin:2, total:2 will keep all copies in the originating site.

[Semen]

If a single node is unavailable in a site, will the index be replicated to a neighboring site? How to avoid it.

[Semen]

Thanks for the answer.
As far as I understand, in a multisite, data is replicated between sites. I need 3 clusters without replication between the clusters, but with the ability to search on all the clusters with one search head.