Deployment Architecture

In a multisite indexer cluster, how can we verify that each peer does not get more than one copy?

rashmigonchikar
Engager

I have set up a Splunk indexer cluster on AWS using the multisite feature. The cluster is spread across 2 AZs. Each AZ has 2 peers.
My site rep factor is: origin:2, site1:2, site2:2, total:4.
I'm assuming that each peer will get only 1 copy of data. Is this assumption right?
If so, how can I verify that each peer does not get more than one copy?

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

Yes, in all indexer clusltering, single-site or multisite, each peer gets at most a single copy.

You might find it useful to review the discussion of how clusters handle buckets across the set of peer nodes: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Bucketsandclusters

This discussion focuses primarily on single-site clusters, but the principles are the same for multisite clusters.

Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...