Splunk Multisite Clustering

[nehadoshi89]

Hi,

I had a question about setting up a multisite cluster. I have two sites: site1 and site2. Per site we have one indexer each and one search Head each. We have one master node say in site one. Can this architecture be used to configure a multisite architecture? I need a replication factor of 2 and search factor of 2. So I had site replication_factor=origin:1,total:2. But this does not work. Any help on this?

Thanks.

[mahamed_splunk]

So you have 2 sites and one indexer in each site. Sure, this will work with origin:2,total:2 settings. What exactly do you mean by this doesn't work? Did you get an error message?

[mahamed_splunk]

Ok. It may be due to the fact that you have 1 indexer on each site but the (default) legacy replication factor is 3. Add the following to your config and restart master

replication_factor=1
search_factor=1

If this still doesn't work, could you post the error messages from splunkd log files?

[nehadoshi89]

Thank you. I tried origin:1, total:2 but the master node did not start up. If I try origin:2, total:3, then it says that search factor and replication factor not met because we do not have equivalent number of peers.