We are deploying a new instance of Splunk Enterprise and have decided on a multisite cluster architecture for high availability and disaster recovery. Unfortunately, we are getting our hardware resources in drops; we have enough resources now to build out one site (site1) and we expect the next drop later this fall/early winter to build out our second site (site2). After that time we expect additional resources to add indexers at each of the two sites.
Our initial hardware will support a 3 peer indexer cluster (with associated master, ds, lm, search, etc.). We would like to have rep factor 3 search factor 2. When we get the resources deployed at site2, we would like to rebalance the buckets from site1 using site2 resources.
Can we initially use the following master and indexer server.conf to enable multisite on day one, the update the conf when site2 is online?
tsheets13 - thank you, that answers my question. I had not stumbled on that section yet!
Post-migration bucket behavior
After migration, all buckets created before migration continue to adhere to their single-site replication and search factor policies, by default. You can alter this behavior so that pre-migration buckets adhere instead to the multisite policies, by changing the constrain_singlesite_buckets setting on the master's server.conf to "false".