Deployment Architecture

Multisite cluster replication and network latency

javiergn
SplunkTrust
SplunkTrust

Hi all,

We are currently planning a multisite cluster deployment with two sites in very different and remote locations: EMEA and India.
I haven't been given too much information about the network link between those sites yet, but in the meantime I've been going through the documentation trying to identify the minimum requirements in terms of network latency and bandwidth between indexers on different physical sites.

The plan is to run Splunk 6.3.1 on RHEL in case that makes any difference.

Thanks for your help,
J

0 Karma

mzorzi
Splunk Employee
Splunk Employee

It is difficult to provide a precise minimum requirement; in fact I would say that try to match the minimum is not a good approach.

Maybe you cluster is indexing hundred lines of syslog per day and the minimum will work; maybe it is a multiterabyte environment and therefore the minimum is not enough.

I would setup a test environment, make sure a connection can be established and maintained between the two sites; make sure data can be transferred in secure copy in a reasonable time and the vast majority of the packets is not being resent. If already at this stage the cluster does not work clearly there is not point to move forward with this environment

javiergn
SplunkTrust
SplunkTrust

Hi, thanks for your answer.
We are looking to index 200 GB/day, which I guess is roughly 2.37 MB/second.

Assuming all my data is replicated between both sites, that is 100GB/day traveling between site A and site B, which requires on average 1.19 MB/second.

Now my questions:

  • Is the above realistic or will the indexers apply any sort of extra compression and therefore reduce the amount of data transferred between sites?
  • What's the impact of your network latency in your index replication? I can see here that we should try to stay below 100 ms but is there any official statement?

Thanks,
J

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...