- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![gduggan1 gduggan1](https://community.splunk.com/legacyfs/online/avatars/385299.jpg)
I have a multisite indexer clustering environment with 2 Indexers in Site1 and 1 Indexer in Site2. What is the recommended Replication factor configuration with different numbers of indexers in different sites? Everything I have read is based on an equal number of indexers in each site.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![esix_splunk esix_splunk](https://community.splunk.com/legacyfs/online/avatars/197958.jpg)
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
So this scenario is a little unique, but not uncommon. This kind of scenario is typically trying to fulfill a DR scenario where having one Indexer at a different site will cover the DR case where site1 disappears..
Here we are assuming that we need to have RF/SF of 3..
available_sites=site1,site2
site_replication_factor=origin:1,site1:2,site2:1,total:3
site_search_factor=origin:1,site1:2,site2:1,total:3
There is an issue with this though, that having a RF/SF 3:3 does use more disk space then say a RF/SF 3:2. See docs @ : http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Sitereplicationfactor
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![esix_splunk esix_splunk](https://community.splunk.com/legacyfs/online/avatars/197958.jpg)
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
So this scenario is a little unique, but not uncommon. This kind of scenario is typically trying to fulfill a DR scenario where having one Indexer at a different site will cover the DR case where site1 disappears..
Here we are assuming that we need to have RF/SF of 3..
available_sites=site1,site2
site_replication_factor=origin:1,site1:2,site2:1,total:3
site_search_factor=origin:1,site1:2,site2:1,total:3
There is an issue with this though, that having a RF/SF 3:3 does use more disk space then say a RF/SF 3:2. See docs @ : http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Sitereplicationfactor
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)