I’m told by the architect lab notes that when we have
site_replication_factor origin:1,total:2 then the
replication_factor is 1.
Is it true?
If it’s true it means that
replication_factor has different meanings in a Multisite Indexer Cluster and in a non-Multisite Indexer Cluster.
The way I read is that
replication_factor is derived directly from
site_replication_factor, which means that in the Multisite conetxt,
replication_factor is redundant. Is it right?
It relates to What is origin when setting a Multisite Indexer Cluster?
* Only valid for 'mode=master' and is only used if 'multisite=true'.
So if multisite isn't equal to true, replicationfactor and searchfactor will be used. Otherwise the site_ factor settings are observed.
Gorgeous @jkat54 - so the architect lab material can be improved ; -)
when multisite is true, we will still use replicationfactor and searchfactor for single-site buckets (buckets created before multisite was enabled), see https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Migratetomultisite#Post-migration_bucket_...
I transferred acceptance to the superior answer 😉
replication_factor is used when multisite is not defined.
When multisite is configured on the master, then
Both settings will be used but only sitereplicationfactor will be used for the replication of site aware buckets.
To test this, try setting a multi-site environment with two sites, one host per site and
site_replication_factor=origin:1,total:2 and keep
replication_factor to it's default of
3 you will get errors as you try to start your cluster. You won't have this error if you have 3 indexers in each site. It's recommended to use :
search_factor=1 when configuring multisite to avoid having such an error.
please see https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Migratetomultisite#Post-migration_bucket_... for more details. if we want multisite capabilities for our old buckets, we can toggle the appropriate flag (and never rely on