Why does multisite clustering require 1 manager node?

[munang]

I have a question about studying multi-site clustering.

In a multi-site clustering environment, search heads and peer nodes exist in one site, but only one manager node exists in a specific site.

I wonder if there is a reason why there shouldn't be one manager node in each site.
When I checked the official documentation, I saw a part that said that the manager node is not a member of any site.

Therefore, for this reason (the manager node does not belong to any site), I wonder if there is only one manager node even in a multi-site clustering environment.

This may not be an appropriate question. It's not enough, but if there are any mistakes, please point out.

[PickleRick]

The cluster manager manages the cluster as a whole. A multisite cluster is still a single cluster, just split into separate sites. At this moment there is no such functionality as "subordinate manager" or something like that.

The manager manages the overall cluster contents - most importantly keeps track of buckets across all cluster and makes sure that both site replication/search factors as well as overall replication/search factors are met. And to do so it must have the overall picture of the whole cluster and buckets contained within every single indexer.

You can have a fail-over cluster manager, possibly located physically in a different site (but still in terms of Splunk site-affinity it's a "site-less" component). But still at any given point in time you have one manager managing whole of the cluster.

[munang]

@PickleRick 

It's late, but thank you so much for your sincere reply!! Even if it is a multi-site, if you think that the cluster itself is one, it is correct that there is one manager node!! I got it right 🙂 Thank you

[munang]

@gcusello 

Thank you very much for your reply. I have another question that I would like to ask. !!

Is it because it is inconvenient to manage when the number of entities managing data replication between peers and sites increases to two?

If the number of sites to be managed increases to 3 or 4, I wonder if there will be a load to manage the replication of the entire site with one manager node.

Even in this case, does it have to exist as one?

[gcusello · Accepted solution]

Hi @munang,

in Splunk Multisite Architecture, there's always one Master Node, even if the number of peers and sites.

But if you have a complex multisite architecture, probably the Community isn't the site to discus your architecture: it should be betetr that you analyze yoru architecture with a Splunk Architect or a Splunk PS.

Anyway, I'll be happy to help you.

Ciao.

Giuseppe

[gcusello]

hi @munang,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @munang,

the main role of Master Node is to manage data replication between peers and sites.

For this reason the Mster Node must be one and the system can run also without it (for a limited time!).

Ciao.

Giuseppe