Deployment Architecture

Multisite Indexer Clustering: How to configure site_replication_factor for two sites so site2 has its own data and a copy of site1, but have site1 only have its own data?


Hi all,

I'm demoing out a setup with two sites, but the only thing site 2 has is an Indexer. The only purpose of the second site's indexer is disaster recovery. The idea is that I want site 2 (IDX2) to have a copy of itself and site 1 (IDX1). However, I only want site 1 to have its own data and not a copy of site 2.

I've been playing around with site_replication_factor and the I think the secret lays in the origin, but I'm really having a hard time wrapping my head around it.

Thanks for any information you can provide!


You can't do it with the search and replication factors.

The best solution is "don't forward any data to site2 indexers." Make sure your forwarders are only sending data to site1 indexers.
If you aren't forwarding any data to site2, it will not be the origin for any data - and so it won't have anything to replicate, regardless of the settings.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...