Deployment Architecture

Minimum peer number for multi site clustering


Hi all,

Am planning a multi site clustering (2 site) installation of Splunk 6.3 as the small start deployment.
Now I'm confused that I can start 2 peers ( 1 peer on 1 site ) or need 3 peers at least ( 2 peer on origin, 1 peer on the other ).

The following answer is saying 2 peers.
Multi-Site Cluster: What would I configure for replication and search factor with 1 peer at each sit...

The following another answer might be saying 3 peers.
link text

Hoping someone could help clarify, thank you!

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

The 3 node cluster minimum applies to search head clusters, not index clusters, so 2 should be fine per the answer above. If you want search head clustering you will need a minimum of 3 sh peers and should keep the total number odd.


You can have multisite clustering with 1 indexer and 1 site and still call it multisite clustering.
It all depend on your needs.

1 peer on site1 and 1 peer on site2 with a replication factor of 2 will give you resiliency against the loss of a site.

If you decided to go for a 2 + 1 peer configuration then could also achieve intra-site resiliency should you decided to go for a replication factor of 3.

Other considerations are performance (remember how map and reduce works), network latency and bandwidth, storage costs, etc.
Combinations are unlimited.

You also need to consider how many search heads you want to deploy and where do you want them to run.

So not sure if the above is helping you or now you have even more questions than before 🙂

EDIT: how much data are you expecting to ingest on a daily basis? where is it located? what sort of data retention needs you have?



Thank you Javiergn,

At this moment, we will start just 30GB. but need DR from the data sensitiveness.

If site1 goes down by some sort of disaster, after the recovery of site1, peer1 on site1 might returns to cluster with no data (no bucket) depending on the situation.
In that case, will full buckets that peer2 on site2 has be copy to peer1 on site1 to remain site_replication_factor?

--assumption configuration--
site_replication_factor = origin:1,site1:1,site2:1,total:2
site_search_factor = origin:1,site1:1,site2:1,total:2

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...