Minimum peer number for multi site clustering

[Shisa]

Hi all,

Am planning a multi site clustering (2 site) installation of Splunk 6.3 as the small start deployment.
Now I'm confused that I can start 2 peers ( 1 peer on 1 site ) or need 3 peers at least ( 2 peer on origin, 1 peer on the other ).

The following answer is saying 2 peers.
Multi-Site Cluster: What would I configure for replication and search factor with 1 peer at each sit...

The following another answer might be saying 3 peers.
link text

Hoping someone could help clarify, thank you!

[adauria_splunk]

The 3 node cluster minimum applies to search head clusters, not index clusters, so 2 should be fine per the answer above. If you want search head clustering you will need a minimum of 3 sh peers and should keep the total number odd.

[javiergn]

You can have multisite clustering with 1 indexer and 1 site and still call it multisite clustering.
It all depend on your needs.

1 peer on site1 and 1 peer on site2 with a replication factor of 2 will give you resiliency against the loss of a site.

If you decided to go for a 2 + 1 peer configuration then could also achieve intra-site resiliency should you decided to go for a replication factor of 3.

Other considerations are performance (remember how map and reduce works), network latency and bandwidth, storage costs, etc.
Combinations are unlimited.

You also need to consider how many search heads you want to deploy and where do you want them to run.

So not sure if the above is helping you or now you have even more questions than before 🙂

EDIT: how much data are you expecting to ingest on a daily basis? where is it located? what sort of data retention needs you have?

Thanks,
J

[Shisa]

Thank you Javiergn,

At this moment, we will start just 30GB. but need DR from the data sensitiveness.

If site1 goes down by some sort of disaster, after the recovery of site1, peer1 on site1 might returns to cluster with no data (no bucket) depending on the situation.
In that case, will full buckets that peer2 on site2 has be copy to peer1 on site1 to remain site_replication_factor?

--assumption configuration--
site_replication_factor = origin:1,site1:1,site2:1,total:2
site_search_factor = origin:1,site1:1,site2:1,total:2