I am configuring a multisite cluster and am confused by this error message. I have 2 sites and 4 nodes. The error message does not make sense. "total should be greater than or equal to replication_factor." Any help is MUCH appreciated.
splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:1,total:2 -site_search_factor origin:1,total:1
Your session is invalid. Please login.
Splunk username: brent
Password:
Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor.
Run the below command & update the replication_factor, site_replication_factor manually in server.conf as below.
splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:2,total:3 -site_search_factor origin:1,total:2
[clustering]
mode = master
multisite = true
available_sites = site1,site2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:2
replication_factor = 2
Refer the below link.
https://answers.splunk.com/answers/294071/indexer-cluster-error-site-replication-factor-orig.html
Can you please try the below command
splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:2,total:3 -site_search_factor origin:1,total:2
Thanks for the response, i already did that and it worked. But to me that seems that I will have a two coopes on origin, is that not the case?
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/MultisiteCLI
When comes to the multisite cluster. You have to go with the default value and you cant reduce it. but you can increase it.
When you say "the default value" what do you mean. This has always confused me about splunk. I would assume origin:1,total:2 would leave one bucket on origin and copy another to the other site. Is this NOT the case?
From your command it says total is 2. But your replication factor is 3. Replication factor is different from site replication factor.
The site_replication_factor replaces the standard replication_factor used with single-site clusters.
So it is not taking. If you have 3 nodes in your environment then it might get work.
If you are not setting any rep factor. by default it will take as origin:2,total:3.
Hope i have answered your question. Please let me know for more clarification.
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitereplicationfactor
So lets try it this way. I have a 2 site cluster, 2 nodes in site one and two nodes in site two. I want one bucket to go to one site, and another to go to the other site. Will this config accomplish that?
No it wont. Because you have 4 nodes with rep factor of 3. total should always greater than or equal to rep factor. In your command you have written the total as 2. thats the reason it showing an error "total should be greater than or equal to replication_factor"
Ok so what am I missing here? How do I put one bucket on origin and one on the other site?
Sorry for the late response. You are putting total as 3. Can you please put origin as 1 and total as 4. It might get work. Please let me know about the status.
Hope I answered your question.