Deployment Architecture

How to configure site awareness on forwarders for multiple multisite clusters

nibinabr
Communicator

I have been reading this doc on how to configure forwarders to use indexer discovery in a multisite cluster. http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/indexerdiscovery#Use_indexer_discovery_in_...

The doc talks about setting the following in server.conf for site awareness.

[general]

site = site-id

How do I configure site awareness if I want my forwarder to talk to site1 in multisite-cluster1 and to site2 in multisite-cluster2?

Thanks in advance.

0 Karma

gjanders
SplunkTrust
SplunkTrust

In the above case your site= setting is going to need to be different for any forwarder in site1 compared to any forwarder in site2.

If you have a server naming convention you could send down different applications from the deployment server which assign the appropriate site to the forwarder based on the name of the endpoint server.

The linked documentation also talks about what to do if you want the forwarders to failover to the other site.

0 Karma

nibinabr
Communicator

Maybe my question wasn't clear enough. My use case is that I want one forwarder to talk to two different multisite clusters and I want to configure site awareness for these two multisite clusters.

0 Karma

gjanders
SplunkTrust
SplunkTrust

If your using indexer discovery you would either use site0 so it talks to both sites of the multisite cluster or if you don't use indexer discovery just send the forwarder to all peer nodes in the required sites.

Or if you want it to talk to a single site and only the other site in a failure case that is also documented in the original link you posted...

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...