What is the retention period and volume limit on reserved copies in multisite indexer clustering

[keerthana_k]

Hi,

Splunk documentation mentions that in case of site failure in a multisite indexer clustering deployment, the master maintains reserved copies of data to be assigned to peers of the non-functional site once it starts functioning again. Is there is any restriction on the time period upto which the reserved copy is kept alive waiting for the site to be up again? Similarly, is there any volume restriction for the same?

Thanks,
Keerthana

[Masa]

1. Site1 and Site2 exisit, at this point all copied buckets of site2 are available in site1
2. CM identify all CPs on Site2 become Down
3. at this point all copied buckets of site2 are still available in site1 => The copied buckets are available until retention policy (size or time) is hit

For more information about retention policy, I recommend to read doc starting from here.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Configureindexstorage