What do we need to back-up in a multi-site cluster?

[danielbb]

We have a multi-site cluster with four indexers on each site and replication factor is at 2. When we back it up, is it enough to back-up one site?

[kgderrekchapin]

Are you backing up for resiliency or for data retention purposes?
What is your site replication factor?

to give you a real quick rundown on site replication. the site specific settings in the [clustering] stanza are:
site_replication_factor = origin:2,total:3
site_search_factor = origin:1,total:2

Origin means how many copies to keep on the originating site. the difference in the total specifies how many copies to keep on other sites.
Only focusing on the replication factor here is an example from above would be the following
Site 1: 2 copies
Site 2: 1 copy

For additional settings and information on replication strategies take a look here.
https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Sitereplicationfactor

If your repfactor doesn't' have the origin and total specified you are likely not replicating across sites.

-Derrek

[danielbb]

The back-up is for resiliency - to be able to restore the data. The site replication factor - I need to check...

[kgderrekchapin]

I think once you have Site replication confirmed you should be good with a single site backup.

But please keep this in mind.

Any data not sync'd across the lines or in transit will be lost if the non backup site died or the connectivity was cut.

If you feel this answer was sufficient please take moment and accept it.

Take care,
Derrek