Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: What is origin when setting a Multisite Indexe...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is origin? I just don't understand what it means...
As in the command -
~/cmaster/bin/splunk edit cluster-config -mode master -multisite true
-site site1 -available_sites site1,site2 -site_replication_factor origin:1,total:2 -site_search_factor origin:1,total:2 -replication_factor 1 -search_factor 1 -secret xxxx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The 'origin' refers to the site which contains the original raw data (bucket). The term -site_replication_factor origin:1,total:2 means that there will be 1 copy of raw data bucket in the site where data was originated (indexed) (1 copy means just the original copy) and there will be a total of 2 copied of that data available in the cluster (so since origin site has 1, other 1 copy (2-1=1) will be replicated to other site(s)).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The 'origin' refers to the site which contains the original raw data (bucket). The term -site_replication_factor origin:1,total:2 means that there will be 1 copy of raw data bucket in the site where data was originated (indexed) (1 copy means just the original copy) and there will be a total of 2 copied of that data available in the cluster (so since origin site has 1, other 1 copy (2-1=1) will be replicated to other site(s)).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Crystal clear as always - thank you @somesoni2 !!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
