I am considering Splunk architecture for a pair of Data Centers. I would like to take advantage of Splunk Indexer Clustering, and the documentation seems to indicate that Clustering across Data Centers is possible, but hasn't been the typical use case.
Has anybody tested or implemented Indexer Clustering across data centers? What is the latency that would cause prevent someone from using clustering? Are there any other pitfalls that could come about from using Index clustering across data centers?
I assume with multisite clustering most of the concerns are solved.
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Multisitedeploymentoverview
HTH,
Holger