Deployment Architecture

Minimum peer number for multi site clustering

Shisa
Explorer

Hi all,

Am planning a multi site clustering (2 site) installation of Splunk 6.3 as the small start deployment.
Now I'm confused that I can start 2 peers ( 1 peer on 1 site ) or need 3 peers at least ( 2 peer on origin, 1 peer on the other ).

The following answer is saying 2 peers.
Multi-Site Cluster: What would I configure for replication and search factor with 1 peer at each sit...

The following another answer might be saying 3 peers.
link text

Hoping someone could help clarify, thank you!

Tags (2)
0 Karma

adauria_splunk
Splunk Employee
Splunk Employee

The 3 node cluster minimum applies to search head clusters, not index clusters, so 2 should be fine per the answer above. If you want search head clustering you will need a minimum of 3 sh peers and should keep the total number odd.

javiergn
SplunkTrust
SplunkTrust

You can have multisite clustering with 1 indexer and 1 site and still call it multisite clustering.
It all depend on your needs.

1 peer on site1 and 1 peer on site2 with a replication factor of 2 will give you resiliency against the loss of a site.

If you decided to go for a 2 + 1 peer configuration then could also achieve intra-site resiliency should you decided to go for a replication factor of 3.

Other considerations are performance (remember how map and reduce works), network latency and bandwidth, storage costs, etc.
Combinations are unlimited.

You also need to consider how many search heads you want to deploy and where do you want them to run.

So not sure if the above is helping you or now you have even more questions than before 🙂

EDIT: how much data are you expecting to ingest on a daily basis? where is it located? what sort of data retention needs you have?

Thanks,
J

Shisa
Explorer

Thank you Javiergn,

At this moment, we will start just 30GB. but need DR from the data sensitiveness.

If site1 goes down by some sort of disaster, after the recovery of site1, peer1 on site1 might returns to cluster with no data (no bucket) depending on the situation.
In that case, will full buckets that peer2 on site2 has be copy to peer1 on site1 to remain site_replication_factor?

--assumption configuration--
site_replication_factor = origin:1,site1:1,site2:1,total:2
site_search_factor = origin:1,site1:1,site2:1,total:2

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...