Deployment Architecture

In a multisite indexer cluster, how can we verify that each peer does not get more than one copy?

rashmigonchikar
Engager

I have set up a Splunk indexer cluster on AWS using the multisite feature. The cluster is spread across 2 AZs. Each AZ has 2 peers.
My site rep factor is: origin:2, site1:2, site2:2, total:4.
I'm assuming that each peer will get only 1 copy of data. Is this assumption right?
If so, how can I verify that each peer does not get more than one copy?

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

Yes, in all indexer clusltering, single-site or multisite, each peer gets at most a single copy.

You might find it useful to review the discussion of how clusters handle buckets across the set of peer nodes: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Bucketsandclusters

This discussion focuses primarily on single-site clusters, but the principles are the same for multisite clusters.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...