Deployment Architecture

Multisite Indexer Cluster - Site with only origin data

felixhuettner
Engager

Hello,

we would like to setup a multisite indexer cluster with 4 sites (1 to 4).
Two of these sites (1 and 2) should have at least on copy of each bucket replicated and searchable.
The two other sites (3 and 4) should only have a copy of each bucket that originated in that site.

As an example:

+-------------+-------------------------------+
|             |    min Number of Buckets      |
+-------------+-------+-------+-------+-------+
| Origin Site | site1 | site2 | site3 | site4 |
+-------------+-------+-------+-------+-------+
|    site 1   |   1   |   1   |   0   |   0   |
+-------------+-------+-------+-------+-------+
|    site 2   |   1   |   1   |   0   |   0   |
+-------------+-------+-------+-------+-------+
|    site 3   |   1   |   1   |   1   |   0   |
+-------------+-------+-------+-------+-------+
|    site 4   |   1   |   1   |   0   |   1   |
+-------------+-------+-------+-------+-------+

My idea would be to use the following configuration:

[clustering]
mode = master
multisite = true
available_sites = site1,site2,site3,site4
replication_factor = 2
site_replication_factor = origin:1,site3:0,site4:0,total:2
site_search_factor = origin:1,site3:0,site4:0,total:2

However it's not possible to set the replication factor of a site to 0 (splunk will throw an error and won't startup)

Do you have any other suggestions how we could setup the system and fulfill the requirements written above?

0 Karma
1 Solution

jcrabb_splunk
Splunk Employee
Splunk Employee

The value of a search factor & replication factor must always be greater than 0. I do not know of an "out of the box" way of fulfilling your request off hand.

Jacob
Sr. Technical Support Engineer

View solution in original post

jcrabb_splunk
Splunk Employee
Splunk Employee

The value of a search factor & replication factor must always be greater than 0. I do not know of an "out of the box" way of fulfilling your request off hand.

Jacob
Sr. Technical Support Engineer
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...