Deployment Architecture
Highlighted

Multisite Indexer Cluster - Site with only origin data

Hello,

we would like to setup a multisite indexer cluster with 4 sites (1 to 4).
Two of these sites (1 and 2) should have at least on copy of each bucket replicated and searchable.
The two other sites (3 and 4) should only have a copy of each bucket that originated in that site.

As an example:

+-------------+-------------------------------+
|             |    min Number of Buckets      |
+-------------+-------+-------+-------+-------+
| Origin Site | site1 | site2 | site3 | site4 |
+-------------+-------+-------+-------+-------+
|    site 1   |   1   |   1   |   0   |   0   |
+-------------+-------+-------+-------+-------+
|    site 2   |   1   |   1   |   0   |   0   |
+-------------+-------+-------+-------+-------+
|    site 3   |   1   |   1   |   1   |   0   |
+-------------+-------+-------+-------+-------+
|    site 4   |   1   |   1   |   0   |   1   |
+-------------+-------+-------+-------+-------+

My idea would be to use the following configuration:

[clustering]
mode = master
multisite = true
available_sites = site1,site2,site3,site4
replication_factor = 2
site_replication_factor = origin:1,site3:0,site4:0,total:2
site_search_factor = origin:1,site3:0,site4:0,total:2

However it's not possible to set the replication factor of a site to 0 (splunk will throw an error and won't startup)

Do you have any other suggestions how we could setup the system and fulfill the requirements written above?

0 Karma
Highlighted

Re: Multisite Indexer Cluster - Site with only origin data

Splunk Employee
Splunk Employee

The value of a search factor & replication factor must always be greater than 0. I do not know of an "out of the box" way of fulfilling your request off hand.

Jacob
Sr. Technical Support Engineer

View solution in original post