Will buckets created in single cluster be replicated across multi-sites when it is migrated to multi-site cluster?
I briefly tested it which appears not being replicated. Can anyone confirm if it’s the case?
Splunk server.conf in version 7.2:
constrain_singlesite_buckets = <boolean>
* Only valid for mode=master and is only used if multisite is true.
* Specifies whether the cluster keeps single-site buckets within one site
in multisite clustering.
* When this setting is "true", buckets in a single site cluster do not
replicate outside of their site. The buckets follow 'replication_factor'
'search factor' policies rather than 'site_replication_factor'
'site_search_factor' policies. This is to mimic the behavior of
single-site clustering.
* When this setting is "false", buckets in non-multisite clusters can
replicate across sites, and must meet the specified
'site_replication_factor' and 'site_search_factor' policies.
* Default: true
Support has been added apparently...
Currently we do not have this capability.
In the upcoming major release this capability may be added .
That is not the case today.
No. Single-site buckets will not be converted to multisite.
That's why it's worth considering creating your installation as a one-site multisite cluster from the beginning so that if at any point you need to extend your cluster you don't have to "convert" it to multisite but simply add another site to it.
OK. I must here correct myself. It was true some time ago but since 7.2.0 we have this:
So with modern Splunk installations you can convert to multisite. Yaay! 🙂
And even back to single-site https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Converttosinglesite.