Multisite Cluster Configuration

[Roger_FB]

Hello,
I have the following question:
I would like to set up a multisite cluster with the following structure:

---------

Site 01:
Node01
Index A

Site 02:
Node02
Index B
Index C

Node03
Index D

SearchHead:
Only via Node02 and Node03

Replication:
Index A and B on Node01, Node02, Node03
Index C and D only on Node02 and Node03

Only the replications should be exchanged between Site 01 and Site 02 (no distributed search)

----------------

Is this possible and what do the configs look like (server.conf, indexes.conf etc)?

Have a great day and thank you very much

[PickleRick · Accepted solution]

No. You cannot define (site) replication/search factors on a per-index level. You can set an index to being non-replicated but cannot go beyond that.

You set (site)SF/RFs at the server level and only define whether the index is replicated at index level.

So to have a setup with some indexes being replicated between sites and some not you'd need to have separate clusters (I'm not sure however how you go about site-affinity for search-heads when you're connecting to multiple clusters - never tried that).

[gcusello]

Hi @Roger_FB ,

at first, this question isn't for the Community but youshould engage a Splunk Architect or a Splunk PS.

Anyway, let me understand:

• you have one Indexer on Site1 and two in Site2
• indexes on Site2 must be replicated only on Indexers in Site2, instead Indexes in Site1 must be replicated also in Site2.

I'm not sure that's possible to have Indexes not replicated in both the Sites.

Ciao.

Giuseppe

[Roger_FB]

Hi Guiseppe,
thanks you for your answer.

---

Anyway, let me understand:

• you have one Indexer on Site1 and two in Site2
• indexes on Site2 must be replicated only on Indexers in Site2, instead Indexes in Site1 must be replicated also in Site2.

---

Yes, that is correct.

Greetings

Roger

[gcusello]

Hi @Roger_FB ,

as me and @PickleRick said, you cannot configure different replication and search factors for each index, but only one for the entire cluster.

You can only define that there are not replicated indexes.

Ciao.

Giuseppe