Deployment Architecture

What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

ddrillic
Ultra Champion

I’m told by the architect lab notes that when we have site_replication_factor origin:1,total:2 then the replication_factor is 1.

Is it true?

If it’s true it means that replication_factor has different meanings in a Multisite Indexer Cluster and in a non-Multisite Indexer Cluster.

The way I read is that replication_factor is derived directly from site_replication_factor, which means that in the Multisite conetxt, replication_factor is redundant. Is it right?

It relates to What is origin when setting a Multisite Indexer Cluster?

Tags (1)
1 Solution

DavidHourani
Super Champion

Hi @ddrillic,

The replication_factor is used when multisite is not defined.

When multisite is configured on the master, then Both settings will be used but only site_replication_factor will be used for the replication of site aware buckets.

To test this, try setting a multi-site environment with two sites, one host per site and site_replication_factor=origin:1,total:2 and keep replication_factor to it's default of 3 you will get errors as you try to start your cluster. You won't have this error if you have 3 indexers in each site. It's recommended to use : replication_factor=1 and search_factor=1 when configuring multisite to avoid having such an error.

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @ddrillic,

The replication_factor is used when multisite is not defined.

When multisite is configured on the master, then Both settings will be used but only site_replication_factor will be used for the replication of site aware buckets.

To test this, try setting a multi-site environment with two sites, one host per site and site_replication_factor=origin:1,total:2 and keep replication_factor to it's default of 3 you will get errors as you try to start your cluster. You won't have this error if you have 3 indexers in each site. It's recommended to use : replication_factor=1 and search_factor=1 when configuring multisite to avoid having such an error.

Cheers,
David

dxu_splunk
Splunk Employee
Splunk Employee

please see https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Migratetomultisite#Post-migration_bucket_... for more details. if we want multisite capabilities for our old buckets, we can toggle the appropriate flag (and never rely on replication_factor)

0 Karma

ddrillic
Ultra Champion

Thank you @DavidHourani

0 Karma

jkat54
SplunkTrust
SplunkTrust
* Only valid for 'mode=master' and is only used if 'multisite=true'.

So if multisite isn't equal to true, replication_factor and search_factor will be used. Otherwise the site_ factor settings are observed.

ddrillic
Ultra Champion

Gorgeous @jkat54 - so the architect lab material can be improved ; -)

0 Karma

dxu_splunk
Splunk Employee
Splunk Employee

when multisite is true, we will still use replication_factor and search_factor for single-site buckets (buckets created before multisite was enabled), see https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Migratetomultisite#Post-migration_bucket_...

jkat54
SplunkTrust
SplunkTrust

I transferred acceptance to the superior answer 😉

ddrillic
Ultra Champion

You are a real gentleman @jkat54 ; -)

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...