Deployment Architecture

Indexer Cluster Error: site_replication_factor={ origin:1, total:2 } is less than replication_factor=3.

harrymclaren
Explorer

I have a multisite cluster with 2 sites and 2 indexers per site. I'm receiving the following error on the cluster master:

site_replication_factor={ origin:1, total:2 } is less than replication_factor=3

The config in server.conf is:

[clustering]
mode = master
multisite = true
available_sites = site1,site2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:2

Now I think the solution to this is to set the 'replication_factor = 2' as if I set this it all works without error. But within Splunk documentation it states that 'site_replication_factor' should be "in place of" 'replication_factor'.

Is this because the default replication factor is 3 and because I have omitted it (as per documentation) it's defaulting to 3?
Can someone confirm if this is a bug or just a documentation error?

Thanks.

Working Config:

    [clustering]
    mode = master
    multisite = true
    available_sites = site1,site2
    site_replication_factor = origin:1,total:2
    site_search_factor = origin:1,total:2
    replication_factor = 2

Link: http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Sitereplicationfactor

1 Solution

Steve_G_
Splunk Employee
Splunk Employee

Thanks for catching that doc issue. I've added a note to http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Sitereplicationfactor which states that you must ensure that the total value is at least as large as the replication_factor. As you indicated, the solution, in case of total = 2, is to explicitly set replication_factor to 2.

View solution in original post

Steve_G_
Splunk Employee
Splunk Employee

Thanks for catching that doc issue. I've added a note to http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Sitereplicationfactor which states that you must ensure that the total value is at least as large as the replication_factor. As you indicated, the solution, in case of total = 2, is to explicitly set replication_factor to 2.

woodcock
Esteemed Legend

I had the same problem just now (v7.1) with search_factor.

DATEVeG
Path Finder

Yeah, i also experienced this bug in 7.1.2.

@Splunk: Please fix this regression

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...