Multisite cluster replication and network latency

[javiergn]

Hi all,

We are currently planning a multisite cluster deployment with two sites in very different and remote locations: EMEA and India.
I haven't been given too much information about the network link between those sites yet, but in the meantime I've been going through the documentation trying to identify the minimum requirements in terms of network latency and bandwidth between indexers on different physical sites.

The plan is to run Splunk 6.3.1 on RHEL in case that makes any difference.

Thanks for your help,
J

[mzorzi]

It is difficult to provide a precise minimum requirement; in fact I would say that try to match the minimum is not a good approach.

Maybe you cluster is indexing hundred lines of syslog per day and the minimum will work; maybe it is a multiterabyte environment and therefore the minimum is not enough.

I would setup a test environment, make sure a connection can be established and maintained between the two sites; make sure data can be transferred in secure copy in a reasonable time and the vast majority of the packets is not being resent. If already at this stage the cluster does not work clearly there is not point to move forward with this environment

[javiergn]

Hi, thanks for your answer.
We are looking to index 200 GB/day, which I guess is roughly 2.37 MB/second.

Assuming all my data is replicated between both sites, that is 100GB/day traveling between site A and site B, which requires on average 1.19 MB/second.

Now my questions:

• Is the above realistic or will the indexers apply any sort of extra compression and therefore reduce the amount of data transferred between sites?
• What's the impact of your network latency in your index replication? I can see here that we should try to stay below 100 ms but is there any official statement?

Thanks,
J