Deployment Architecture

Splunk 5 clusters

DTERM
Contributor

I've heard that splunk 5 clusters do not work well when the nodes are separated over distances (like a WAN). Why is that? Would it make a difference to the cluster if we had a high speed connection (line 100mbps) between two data centers? What are other limitations to clustering across multiple data centers?

Tags (1)
1 Solution

ChrisG
Splunk Employee
Splunk Employee

From the System requirements and other deployment considerations topic in the Managing Indexers and Clusters manual:

"With sufficiently high-quality connections, it is possible to deploy the cluster across data centers. However, in the current version of Splunk, the cluster is not site-aware. For example, in a scenario where you have peer nodes spread across two data centers, you cannot specify that one replicated copy of the cluster data reside on nodes in one data center and a second copy reside on nodes in a second data center. When the master determines how some set of data gets replicated across the cluster, it does not take peer location into consideration."

View solution in original post

kristian_kolb
Ultra Champion

Have you gotten to test it yet? If so, what was your experience?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

From the System requirements and other deployment considerations topic in the Managing Indexers and Clusters manual:

"With sufficiently high-quality connections, it is possible to deploy the cluster across data centers. However, in the current version of Splunk, the cluster is not site-aware. For example, in a scenario where you have peer nodes spread across two data centers, you cannot specify that one replicated copy of the cluster data reside on nodes in one data center and a second copy reside on nodes in a second data center. When the master determines how some set of data gets replicated across the cluster, it does not take peer location into consideration."

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...