Deployment Architecture

Multi Site Indexer Clustering Config help

rakesh_498115
Motivator

Hi Team.

I have my indexers present in 2 sites , site1 and site2. In site1 i have 5 indexers servers and in site2 i have 5 indexers servers. Now all i needed for my multi site indexer clustering configuration is "For each data available in site1 , i need a copy of it in site 2 and viceversa".

I have defined the following config but it seems not working as expected , am i missing something ??

// Master Config

[general]
site=site1

[clustering]
mode=master
multisite=true
available_sites=site1,site2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:2
restart_timeout = 900


// Site 1 Memeber Config

[general]
site=site1

[clustering]
master_uri = https://masterserver:52400
mode = slave
pass4SymmKey=splunk

[replication_port://52403]

// SIte 2 Member Config.

[general]
site=site2

[clustering]
master_uri = https://masterserver:52400
mode = slave
pass4SymmKey=splunk

[replication_port://52403]

Can you please help.

Thanks,
Rakesh.

Tags (1)
0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

Did you set your cluster master management port to: 52400 in web.conf? (You didn't show that)

Perhaps if you had some snippets from the splunkd.log file from one of the indexers and the cluster master it would help.

0 Karma

Masa
Splunk Employee
Splunk Employee

The configuration seems correct.
Please explain why you think it seems not working as expected. How are you checking to verify that?

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...