Deployment Architecture

With multi-site clustering, can I replicate per index?

a212830
Champion

As I prefer to upgrade to 6.3, I'm debating whether to use multi-site clustering. We don't currently replicate any data, but that could happen in the future, on a specific index level. Looking at this doc - http://docs.splunk.com/Documentation/Splunk/6.2.7/Indexer/Multisiteclusters , I'm wondering if replication is all or nothing at the clustering layer.

Does anyone know if you can specifically replicate per index with multi-site clustering?

0 Karma

lguinn2
Legend

Regardless of whether you do single-site clustering or multi-site clustering, you must always specify which indexes should be replicated.
Simply set up clustering, and then add the following in indexes.conf to each index that you want replicated:

repFactor=auto

Lucas_K
Motivator

In addition to the repFactor=auto comment you can actually disable replication per index by using repFactor=0 in each stanza.

This can be useful for cherry picking which indexes to replicate or not depending on your situation.

0 Karma

a212830
Champion

Thanks. My other question is, with multi-site clustering, if I do replicate, will it automatically be sent to another site? My guess is yes, and that's the whole purpose...

0 Karma

lguinn2
Legend

If you set up multi-site clustering, you must tell Splunk how many copies go to each of the sites.

Once set up, replication is automatic.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

This page (and the one after) expose the settings that let you control how many copies are replicated at the origin site and how many at alternate sites (if any): http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Sitereplicationfactor

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...