Deployment Architecture

Multisite cluster replication and network latency

Super Champion

Hi all,

We are currently planning a multisite cluster deployment with two sites in very different and remote locations: EMEA and India.
I haven't been given too much information about the network link between those sites yet, but in the meantime I've been going through the documentation trying to identify the minimum requirements in terms of network latency and bandwidth between indexers on different physical sites.

The plan is to run Splunk 6.3.1 on RHEL in case that makes any difference.

Thanks for your help,

0 Karma

Splunk Employee
Splunk Employee

It is difficult to provide a precise minimum requirement; in fact I would say that try to match the minimum is not a good approach.

Maybe you cluster is indexing hundred lines of syslog per day and the minimum will work; maybe it is a multiterabyte environment and therefore the minimum is not enough.

I would setup a test environment, make sure a connection can be established and maintained between the two sites; make sure data can be transferred in secure copy in a reasonable time and the vast majority of the packets is not being resent. If already at this stage the cluster does not work clearly there is not point to move forward with this environment

Super Champion

Hi, thanks for your answer.
We are looking to index 200 GB/day, which I guess is roughly 2.37 MB/second.

Assuming all my data is replicated between both sites, that is 100GB/day traveling between site A and site B, which requires on average 1.19 MB/second.

Now my questions:

  • Is the above realistic or will the indexers apply any sort of extra compression and therefore reduce the amount of data transferred between sites?
  • What's the impact of your network latency in your index replication? I can see here that we should try to stay below 100 ms but is there any official statement?


0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...