Deployment Architecture

How to configure site awareness on forwarders for multiple multisite clusters

nibinabr
Communicator

I have been reading this doc on how to configure forwarders to use indexer discovery in a multisite cluster. http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/indexerdiscovery#Use_indexer_discovery_in_...

The doc talks about setting the following in server.conf for site awareness.

[general]

site = site-id

How do I configure site awareness if I want my forwarder to talk to site1 in multisite-cluster1 and to site2 in multisite-cluster2?

Thanks in advance.

0 Karma

gjanders
SplunkTrust
SplunkTrust

In the above case your site= setting is going to need to be different for any forwarder in site1 compared to any forwarder in site2.

If you have a server naming convention you could send down different applications from the deployment server which assign the appropriate site to the forwarder based on the name of the endpoint server.

The linked documentation also talks about what to do if you want the forwarders to failover to the other site.

0 Karma

nibinabr
Communicator

Maybe my question wasn't clear enough. My use case is that I want one forwarder to talk to two different multisite clusters and I want to configure site awareness for these two multisite clusters.

0 Karma

gjanders
SplunkTrust
SplunkTrust

If your using indexer discovery you would either use site0 so it talks to both sites of the multisite cluster or if you don't use indexer discovery just send the forwarder to all peer nodes in the required sites.

Or if you want it to talk to a single site and only the other site in a failure case that is also documented in the original link you posted...

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...