I am testing Splunk Enterprise Multi-Site Cluster in my lab. The details of which are mentioned below :
Site1 - Master , Index Peers 1 and 2 , Search Head , and 1 Universal Forwarder.
Site2 - Index Peers 1 and 2, Search Head, and 2 Universal Forwarders.
mode = master
multisite = true
site_replication_factor = origin:2,site1:1,site2:1,total:4
site_search_factor = origin:2,site1:1,site2:1,total:3
I am facing 2 issues :
(I have proper DNS setup for both the sites.)
Please let me know if i have goofed up configuration or my assumptions are not right for a 2 site Multi-Cluster configuration. Aslo please let me know if any additional information is needed.
Splunk - 6.1.3 and splunkforwarder 6.1.3
2 . Make sure all the instances have / must have unique guId value in in instance.cfg
guid = B58A86D9-DF3D-4BF8-A426-DB85C231B699
For #2: try setting replication_factor=2. You may have old buckets that were created before multisite - and those follow a different set of rules than that of multisite buckets.