Deployment Architecture

Why replication factor is not met and search head only shows localhost in Splunk Enterprise 6.1.3 multi-site cluster?



I am testing Splunk Enterprise Multi-Site Cluster in my lab. The details of which are mentioned below :

Site1 - Master , Index Peers 1 and 2 , Search Head , and 1 Universal Forwarder.
Site2 - Index Peers 1 and 2, Search Head, and 2 Universal Forwarders.

mode = master
multisite = true
site_replication_factor = origin:2,site1:1,site2:1,total:4
site_search_factor = origin:2,site1:1,site2:1,total:3

I am facing 2 issues :

1 - If I am checking logs on the other Search Head when the one in the site goes down , I am able to find those logs but , the name of the host from which the logs have come is shown as localhost.

(I have proper DNS setup for both the sites.)

2 - My Master says that the replication factor has not been met.

Please let me know if i have goofed up configuration or my assumptions are not right for a 2 site Multi-Cluster configuration. Aslo please let me know if any additional information is needed.

CentOS 6.3
Splunk - 6.1.3 and splunkforwarder 6.1.3

0 Karma

  1. Kindly confirm/recheck in server.conf servername field. serverName = $HOSTNAME

2 . Make sure all the instances have / must have unique guId value in in instance.cfg
guid = B58A86D9-DF3D-4BF8-A426-DB85C231B699

0 Karma

Engager is the answer to my 1st question.

Will try the solution for Ques #2 and update.


Splunk Employee
Splunk Employee

For #2: try setting replication_factor=2. You may have old buckets that were created before multisite - and those follow a different set of rules than that of multisite buckets.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!