Deployment Architecture

Multisite Indexer Cluster - Site with only origin data

felixhuettner
Engager

Hello,

we would like to setup a multisite indexer cluster with 4 sites (1 to 4).
Two of these sites (1 and 2) should have at least on copy of each bucket replicated and searchable.
The two other sites (3 and 4) should only have a copy of each bucket that originated in that site.

As an example:

+-------------+-------------------------------+
|             |    min Number of Buckets      |
+-------------+-------+-------+-------+-------+
| Origin Site | site1 | site2 | site3 | site4 |
+-------------+-------+-------+-------+-------+
|    site 1   |   1   |   1   |   0   |   0   |
+-------------+-------+-------+-------+-------+
|    site 2   |   1   |   1   |   0   |   0   |
+-------------+-------+-------+-------+-------+
|    site 3   |   1   |   1   |   1   |   0   |
+-------------+-------+-------+-------+-------+
|    site 4   |   1   |   1   |   0   |   1   |
+-------------+-------+-------+-------+-------+

My idea would be to use the following configuration:

[clustering]
mode = master
multisite = true
available_sites = site1,site2,site3,site4
replication_factor = 2
site_replication_factor = origin:1,site3:0,site4:0,total:2
site_search_factor = origin:1,site3:0,site4:0,total:2

However it's not possible to set the replication factor of a site to 0 (splunk will throw an error and won't startup)

Do you have any other suggestions how we could setup the system and fulfill the requirements written above?

0 Karma
1 Solution

jcrabb_splunk
Splunk Employee
Splunk Employee

The value of a search factor & replication factor must always be greater than 0. I do not know of an "out of the box" way of fulfilling your request off hand.

Jacob
Sr. Technical Support Engineer

View solution in original post

jcrabb_splunk
Splunk Employee
Splunk Employee

The value of a search factor & replication factor must always be greater than 0. I do not know of an "out of the box" way of fulfilling your request off hand.

Jacob
Sr. Technical Support Engineer
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...