Am planning a multi site clustering (2 site) installation of Splunk 6.3 as the small start deployment.
Now I'm confused that I can start 2 peers ( 1 peer on 1 site ) or need 3 peers at least ( 2 peer on origin, 1 peer on the other ).
The 3 node cluster minimum applies to search head clusters, not index clusters, so 2 should be fine per the answer above. If you want search head clustering you will need a minimum of 3 sh peers and should keep the total number odd.
At this moment, we will start just 30GB. but need DR from the data sensitiveness.
If site1 goes down by some sort of disaster, after the recovery of site1, peer1 on site1 might returns to cluster with no data (no bucket) depending on the situation.
In that case, will full buckets that peer2 on site2 has be copy to peer1 on site1 to remain site_replication_factor?