How to configure site awareness on forwarders for multiple multisite clusters

[nibinabr]

I have been reading this doc on how to configure forwarders to use indexer discovery in a multisite cluster. http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/indexerdiscovery#Use_indexer_discovery_in_...

The doc talks about setting the following in server.conf for site awareness.

[general]

site = site-id

How do I configure site awareness if I want my forwarder to talk to site1 in multisite-cluster1 and to site2 in multisite-cluster2?

Thanks in advance.

[gjanders]

In the above case your site= setting is going to need to be different for any forwarder in site1 compared to any forwarder in site2.

If you have a server naming convention you could send down different applications from the deployment server which assign the appropriate site to the forwarder based on the name of the endpoint server.

The linked documentation also talks about what to do if you want the forwarders to failover to the other site.

[nibinabr]

Maybe my question wasn't clear enough. My use case is that I want one forwarder to talk to two different multisite clusters and I want to configure site awareness for these two multisite clusters.

[gjanders]

If your using indexer discovery you would either use site0 so it talks to both sites of the multisite cluster or if you don't use indexer discovery just send the forwarder to all peer nodes in the required sites.

Or if you want it to talk to a single site and only the other site in a failure case that is also documented in the original link you posted...