Deployment Architecture
Highlighted

What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

Ultra Champion

I’m told by the architect lab notes that when we have site_replication_factor origin:1,total:2 then the replication_factor is 1.

Is it true?

If it’s true it means that replication_factor has different meanings in a Multisite Indexer Cluster and in a non-Multisite Indexer Cluster.

The way I read is that replication_factor is derived directly from site_replication_factor, which means that in the Multisite conetxt, replication_factor is redundant. Is it right?

It relates to What is origin when setting a Multisite Indexer Cluster?

Tags (1)
Highlighted

Re: What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

SplunkTrust
SplunkTrust
* Only valid for 'mode=master' and is only used if 'multisite=true'.

So if multisite isn't equal to true, replicationfactor and searchfactor will be used. Otherwise the site_ factor settings are observed.

Highlighted

Re: What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

Ultra Champion

Gorgeous @jkat54 - so the architect lab material can be improved ; -)

0 Karma
Highlighted

Re: What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

Splunk Employee
Splunk Employee

when multisite is true, we will still use replicationfactor and searchfactor for single-site buckets (buckets created before multisite was enabled), see https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Migratetomultisite#Post-migration_bucket_...

Highlighted

Re: What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

SplunkTrust
SplunkTrust

I transferred acceptance to the superior answer 😉

Highlighted

Re: What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

Ultra Champion

You are a real gentleman @jkat54 ; -)

0 Karma
Highlighted

Re: What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

SplunkTrust
SplunkTrust

Hi @ddrillic,

The replication_factor is used when multisite is not defined.

When multisite is configured on the master, then Both settings will be used but only sitereplicationfactor will be used for the replication of site aware buckets.

To test this, try setting a multi-site environment with two sites, one host per site and site_replication_factor=origin:1,total:2 and keep replication_factor to it's default of 3 you will get errors as you try to start your cluster. You won't have this error if you have 3 indexers in each site. It's recommended to use : replication_factor=1 and search_factor=1 when configuring multisite to avoid having such an error.

Cheers,
David

View solution in original post

Highlighted

Re: What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

Ultra Champion

Thank you @DavidHourani

0 Karma
Highlighted

Re: What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?

Splunk Employee
Splunk Employee

please see https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Migratetomultisite#Post-migration_bucket_... for more details. if we want multisite capabilities for our old buckets, we can toggle the appropriate flag (and never rely on replication_factor)

0 Karma