Deployment Architecture

Multisite cluster replication and network latency

javiergn
SplunkTrust
SplunkTrust

Hi all,

We are currently planning a multisite cluster deployment with two sites in very different and remote locations: EMEA and India.
I haven't been given too much information about the network link between those sites yet, but in the meantime I've been going through the documentation trying to identify the minimum requirements in terms of network latency and bandwidth between indexers on different physical sites.

The plan is to run Splunk 6.3.1 on RHEL in case that makes any difference.

Thanks for your help,
J

0 Karma

mzorzi
Splunk Employee
Splunk Employee

It is difficult to provide a precise minimum requirement; in fact I would say that try to match the minimum is not a good approach.

Maybe you cluster is indexing hundred lines of syslog per day and the minimum will work; maybe it is a multiterabyte environment and therefore the minimum is not enough.

I would setup a test environment, make sure a connection can be established and maintained between the two sites; make sure data can be transferred in secure copy in a reasonable time and the vast majority of the packets is not being resent. If already at this stage the cluster does not work clearly there is not point to move forward with this environment

javiergn
SplunkTrust
SplunkTrust

Hi, thanks for your answer.
We are looking to index 200 GB/day, which I guess is roughly 2.37 MB/second.

Assuming all my data is replicated between both sites, that is 100GB/day traveling between site A and site B, which requires on average 1.19 MB/second.

Now my questions:

  • Is the above realistic or will the indexers apply any sort of extra compression and therefore reduce the amount of data transferred between sites?
  • What's the impact of your network latency in your index replication? I can see here that we should try to stay below 100 ms but is there any official statement?

Thanks,
J

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...