Deployment Architecture

Multisite Indexer Cluster - Site with only origin data

felixhuettner
Engager

Hello,

we would like to setup a multisite indexer cluster with 4 sites (1 to 4).
Two of these sites (1 and 2) should have at least on copy of each bucket replicated and searchable.
The two other sites (3 and 4) should only have a copy of each bucket that originated in that site.

As an example:

+-------------+-------------------------------+
|             |    min Number of Buckets      |
+-------------+-------+-------+-------+-------+
| Origin Site | site1 | site2 | site3 | site4 |
+-------------+-------+-------+-------+-------+
|    site 1   |   1   |   1   |   0   |   0   |
+-------------+-------+-------+-------+-------+
|    site 2   |   1   |   1   |   0   |   0   |
+-------------+-------+-------+-------+-------+
|    site 3   |   1   |   1   |   1   |   0   |
+-------------+-------+-------+-------+-------+
|    site 4   |   1   |   1   |   0   |   1   |
+-------------+-------+-------+-------+-------+

My idea would be to use the following configuration:

[clustering]
mode = master
multisite = true
available_sites = site1,site2,site3,site4
replication_factor = 2
site_replication_factor = origin:1,site3:0,site4:0,total:2
site_search_factor = origin:1,site3:0,site4:0,total:2

However it's not possible to set the replication factor of a site to 0 (splunk will throw an error and won't startup)

Do you have any other suggestions how we could setup the system and fulfill the requirements written above?

0 Karma
1 Solution

jcrabb_splunk
Splunk Employee
Splunk Employee

The value of a search factor & replication factor must always be greater than 0. I do not know of an "out of the box" way of fulfilling your request off hand.

Jacob
Sr. Technical Support Engineer

View solution in original post

jcrabb_splunk
Splunk Employee
Splunk Employee

The value of a search factor & replication factor must always be greater than 0. I do not know of an "out of the box" way of fulfilling your request off hand.

Jacob
Sr. Technical Support Engineer
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...