I have this in server.conf on my search heads:
[general]
pass4SymmKey = $$$$$$$$$$$$$$$$$
serverName = xxx-xxxxxxxx
site = site1
[clustering]
master_uri = https://xx.xx.xx.xx:8089
mode = searchhead
multisite = true
pass4SymmKey = $$$$$$$$$$$$$$$$$
But my search results come from the splunk_server at sites1 and site2. Any idea why?
Site affinity was actually working. The other site's splunk_server was only returning results for buckets which had not replicated.
Duh. Yes, I felt like an idiot.
Site affinity was actually working. The other site's splunk_server was only returning results for buckets which had not replicated.
Duh. Yes, I felt like an idiot.
Is your cluster in site1 valid and complete, i.e. search and replication factors met and all peers up?
Yes, it is valid and complete.