multi-site cluster replication

[hazem]

-in multi-site cluster if initially, the replication factor was

site_replication_factor = origin:2,total:2

site_search_factor =origin:1,total:1

 and later I change it to

site_replication_factor = origin:2,total:3

site_search_factor =origin:1,total:2

Will the old data also be replicated with  new replication and search factor Or only the new data will have the replication copies as per new replication and search factors

[hazem]

HI @gcusello 

what will  this command  do? 

We have been running our indexer cluster as a multisite cluster with 3 indexers in our main site for the past year. With the below configuration:

 site_replication_factor = origin:2,total:2

site_search_factor = origin:1,total:1

 now we have decided to establish a disaster recovery site with an additional 3 indexers.

 The expected configuration for the new DR site will be as follows:

 site_replication_factor = origin:2, total:3

site_search_factor = origin:1, total:2

will the replication process start syncing all logs in the hot, warm and cold buckets  (approximately 20TB )  to DR indexers or will start real-time hot logs only??

[gcusello]

Hi @hazem ,

did you read https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Migratetomultisite#How_the_cluster_migrat... ?

especially "If you have a large number of existing buckets, the process can take a long time to complete".

Anyway, migration from single site to multisite is a job for a Certified Splunk Architect, not for the Community.

Ciao.

Giuseppe

[gcusello]

Hi @hazem ,

I hint to follow the Splunk Cluster Administration training.

Otherwise, did you followed the steps at https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Migratetomultisite ?

so try with 

constrain_singlesite_buckets = false

Ciao.

Giuseppe