Deployment Architecture
Highlighted

Splunk Multisite Clustering

New Member

Hi,

I had a question about setting up a multisite cluster. I have two sites: site1 and site2. Per site we have one indexer each and one search Head each. We have one master node say in site one. Can this architecture be used to configure a multisite architecture? I need a replication factor of 2 and search factor of 2. So I had site replication_factor=origin:1,total:2. But this does not work. Any help on this?

Thanks.

0 Karma
Highlighted

Re: Splunk Multisite Clustering

Splunk Employee
Splunk Employee

So you have 2 sites and one indexer in each site. Sure, this will work with origin:2,total:2 settings. What exactly do you mean by this doesn't work? Did you get an error message?

0 Karma
Highlighted

Re: Splunk Multisite Clustering

New Member

Thank you. I tried origin:1, total:2 but the master node did not start up. If I try origin:2, total:3, then it says that search factor and replication factor not met because we do not have equivalent number of peers.

0 Karma
Highlighted

Re: Splunk Multisite Clustering

Splunk Employee
Splunk Employee

Ok. It may be due to the fact that you have 1 indexer on each site but the (default) legacy replication factor is 3. Add the following to your config and restart master

replicationfactor=1
search
factor=1

If this still doesn't work, could you post the error messages from splunkd log files?

0 Karma