- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- What is origin when setting a Multisite Indexer Cl...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is origin? I just don't understand what it means...
As in the command -
~/cmaster/bin/splunk edit cluster-config -mode master -multisite true
-site site1 -available_sites site1,site2 -site_replication_factor origin:1,total:2 -site_search_factor origin:1,total:2 -replication_factor 1 -search_factor 1 -secret xxxx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The 'origin' refers to the site which contains the original raw data (bucket). The term -site_replication_factor origin:1,total:2 means that there will be 1 copy of raw data bucket in the site where data was originated (indexed) (1 copy means just the original copy) and there will be a total of 2 copied of that data available in the cluster (so since origin site has 1, other 1 copy (2-1=1) will be replicated to other site(s)).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The 'origin' refers to the site which contains the original raw data (bucket). The term -site_replication_factor origin:1,total:2 means that there will be 1 copy of raw data bucket in the site where data was originated (indexed) (1 copy means just the original copy) and there will be a total of 2 copied of that data available in the cluster (so since origin site has 1, other 1 copy (2-1=1) will be replicated to other site(s)).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Crystal clear as always - thank you @somesoni2 !!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Harnessing Splunk’s Federated Search for Amazon S3
Infographic provides the TL;DR for the 2024 Splunk Career Impact Report
Enterprise Security Content Update (ESCU) | New Releases
