Deployment Architecture

How to configure site awareness on forwarders for multiple multisite clusters

nibinabr
Communicator

I have been reading this doc on how to configure forwarders to use indexer discovery in a multisite cluster. http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/indexerdiscovery#Use_indexer_discovery_in_...

The doc talks about setting the following in server.conf for site awareness.

[general]

site = site-id

How do I configure site awareness if I want my forwarder to talk to site1 in multisite-cluster1 and to site2 in multisite-cluster2?

Thanks in advance.

0 Karma

gjanders
SplunkTrust
SplunkTrust

In the above case your site= setting is going to need to be different for any forwarder in site1 compared to any forwarder in site2.

If you have a server naming convention you could send down different applications from the deployment server which assign the appropriate site to the forwarder based on the name of the endpoint server.

The linked documentation also talks about what to do if you want the forwarders to failover to the other site.

0 Karma

nibinabr
Communicator

Maybe my question wasn't clear enough. My use case is that I want one forwarder to talk to two different multisite clusters and I want to configure site awareness for these two multisite clusters.

0 Karma

gjanders
SplunkTrust
SplunkTrust

If your using indexer discovery you would either use site0 so it talks to both sites of the multisite cluster or if you don't use indexer discovery just send the forwarder to all peer nodes in the required sites.

Or if you want it to talk to a single site and only the other site in a failure case that is also documented in the original link you posted...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...