Deployment Architecture

Indexer Cluster Error: site_replication_factor={ origin:1, total:2 } is less than replication_factor=3.

harrymclaren
Explorer

I have a multisite cluster with 2 sites and 2 indexers per site. I'm receiving the following error on the cluster master:

site_replication_factor={ origin:1, total:2 } is less than replication_factor=3

The config in server.conf is:

[clustering]
mode = master
multisite = true
available_sites = site1,site2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:2

Now I think the solution to this is to set the 'replication_factor = 2' as if I set this it all works without error. But within Splunk documentation it states that 'site_replication_factor' should be "in place of" 'replication_factor'.

Is this because the default replication factor is 3 and because I have omitted it (as per documentation) it's defaulting to 3?
Can someone confirm if this is a bug or just a documentation error?

Thanks.

Working Config:

    [clustering]
    mode = master
    multisite = true
    available_sites = site1,site2
    site_replication_factor = origin:1,total:2
    site_search_factor = origin:1,total:2
    replication_factor = 2

Link: http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Sitereplicationfactor

1 Solution

Steve_G_
Splunk Employee
Splunk Employee

Thanks for catching that doc issue. I've added a note to http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Sitereplicationfactor which states that you must ensure that the total value is at least as large as the replication_factor. As you indicated, the solution, in case of total = 2, is to explicitly set replication_factor to 2.

View solution in original post

Steve_G_
Splunk Employee
Splunk Employee

Thanks for catching that doc issue. I've added a note to http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Sitereplicationfactor which states that you must ensure that the total value is at least as large as the replication_factor. As you indicated, the solution, in case of total = 2, is to explicitly set replication_factor to 2.

woodcock
Esteemed Legend

I had the same problem just now (v7.1) with search_factor.

DATEVeG
Path Finder

Yeah, i also experienced this bug in 7.1.2.

@Splunk: Please fix this regression

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...