What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

[ddrillic]

I’m told by the architect lab notes that when we have site_replication_factor origin:1,total:2 then the replication_factor is 1.

Is it true?

If it’s true it means that replication_factor has different meanings in a Multisite Indexer Cluster and in a non-Multisite Indexer Cluster.

The way I read is that replication_factor is derived directly from site_replication_factor, which means that in the Multisite conetxt, replication_factor is redundant. Is it right?

It relates to What is origin when setting a Multisite Indexer Cluster?

[DavidHourani · Accepted solution]

Hi @ddrillic,

The replication_factor is used when multisite is not defined.

When multisite is configured on the master, then Both settings will be used but only site_replication_factor will be used for the replication of site aware buckets.

To test this, try setting a multi-site environment with two sites, one host per site and site_replication_factor=origin:1,total:2 and keep replication_factor to it's default of 3 you will get errors as you try to start your cluster. You won't have this error if you have 3 indexers in each site. It's recommended to use : replication_factor=1 and search_factor=1 when configuring multisite to avoid having such an error.

Cheers,
David

[dxu_splunk]

please see https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Migratetomultisite#Post-migration_bucket_... for more details. if we want multisite capabilities for our old buckets, we can toggle the appropriate flag (and never rely on replication_factor)

[ddrillic]

Thank you @DavidHourani

[jkat54]

* Only valid for 'mode=master' and is only used if 'multisite=true'.

So if multisite isn't equal to true, replication_factor and search_factor will be used. Otherwise the site_ factor settings are observed.

[ddrillic]

Gorgeous @jkat54 - so the architect lab material can be improved ; -)

[dxu_splunk]

when multisite is true, we will still use replication_factor and search_factor for single-site buckets (buckets created before multisite was enabled), see https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Migratetomultisite#Post-migration_bucket_...

[jkat54]

I transferred acceptance to the superior answer 😉

[ddrillic]

You are a real gentleman @jkat54 ; -)