Multisite Cluster

[msaleh7422]

I’m relatively new to Splunk and currently designing my first production architecture, so I’d really appreciate your guidance.

I’m considering a Multisite Indexer Cluster, but due to current constraints, my plan is:

• Start by implementing the entire environment in one site (HQ)

• After a few months, build and add a DR site

• Eventually convert this setup into a full multisite cluster

My questions are:

1. Is this approach recommended or supported by Splunk?

2. Are there any design decisions I must take from day one to avoid rework later?

3. Would it be better (for a beginner) to:

   • Start with a single-site indexer cluster, then migrate to multisite later?

   • Or design it as multisite from the beginning, even if the second site doesn’t exist yet?

I want to follow best practices but also keep things simple and safe, especially since this is my first real

[PickleRick]

AS @richgalloway already hinted - since you're creating a cluster anyway, there's really no significant difference between a single site cluster and a multisite cluster with just one site. So go for multisite cluster setup but define only one site for now. Then you'll be able to add another site later.

It's a perfectly well supported setup (and even encouraged).

[livehybrid · Accepted solution]

Hi @msaleh7422 

I guess you need to think about what the DR site would be if it *wasnt* a Multisite cluster? e.g. how you would get data to it etc.

I would build it as though its a multisite cluster but with a single site to start with (site1) - this way you can later add an additional site and allow the buckets to replicate to the second/new site (site2). When you add the second site the cluster will attempt to replicate all the existing data to meet the site_replication_factor - the amount of time this will take will obviously depend on how long it runs as a single site. You will need to ensure you have adequate bandwidth to allow for this to complete.

Check out https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Migratetomultisite and https://www.splunk.com/en_us/pdfs/white-paper/splunk-validated-architectures.pdf (M2 Architecture) for more information.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[richgalloway]

Your plan is a good one.  I strongly recommend starting with a multisite cluster from the beginning to avoid extra work when you add the second site.