Deployment Architecture

Will buckets created in a single indexer cluster be replicated across multiple sites when migrated to a multisite cluster?

rbal_splunk
Splunk Employee
Splunk Employee

Will buckets created in single cluster be replicated across multi-sites when it is migrated to multi-site cluster?
I briefly tested it which appears not being replicated. Can anyone confirm if it’s the case?

0 Karma

gjanders
SplunkTrust
SplunkTrust

Splunk server.conf in version 7.2:

constrain_singlesite_buckets = <boolean>
* Only valid for mode=master and is only used if multisite is true.
* Specifies whether the cluster keeps single-site buckets within one site
  in multisite clustering.
* When this setting is "true", buckets in a single site cluster do not
  replicate outside of their site. The buckets follow 'replication_factor'
  'search factor' policies rather than 'site_replication_factor'
  'site_search_factor' policies. This is to mimic the behavior of
  single-site clustering.
* When this setting is "false", buckets in non-multisite clusters can
  replicate across sites, and must meet the specified
  'site_replication_factor' and 'site_search_factor' policies.
* Default: true

Support has been added apparently...

rbal_splunk
Splunk Employee
Splunk Employee

Currently we do not have this capability.

In the upcoming major release this capability may be added .

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

That is not the case today.

0 Karma

rajashaey
Explorer

I would like know, if this feature has added now?

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

No. Single-site buckets will not be converted to multisite.

That's why it's worth considering creating your installation as a one-site multisite cluster from the beginning so that if at any point you need to extend your cluster you don't have to "convert" it to multisite but simply add another site to it.

PickleRick
SplunkTrust
SplunkTrust

OK. I must here correct myself. It was true some time ago but since 7.2.0 we have this:

https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Migratetomultisite#Convert_legacy_buckets...

So with modern Splunk installations you can convert to multisite. Yaay! 🙂

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...