Getting Data In

Multi sites indexers without the same number of peers

davidf_bkk
New Member

Hello,

I currently have a multi site clustering.

Our architecture have 2 sites, and these 2 sites don't have the same number of indexers :

Site 1 : 2 indexers (200 Gb each)
Site 2 : 1 indexer (400 Gb)

My configuration is the following :

site_replication_factor = origin:1,site1:1,site2:1,total:2
site_search_factor = origin:2,site1:1,site2:1,total:2

But by doing this, I seem that a data redudancy occur on site 1,

For example I have an index which is limited to 15Gb :
Site1 : idx1 : full (15gb/15gb)
Site1 : idx2 : full (15gb/15gb)
Site2 : idx1 : full (15gb/15gb)

With a replication factor of 2, shouldn't be like this ? =>
Site1 : idx1 : half (7.5gb/15gb)
Site1 : idx2 : half (7.5gb/15gb)
Site2 : idx1 : full (15gb/15gb)

Of course, I want the data replicated between site 1 and 2. I have only one search head on site 1.

If I try the following :

replication_factor = 2
search_factor = 1

What happen ? Should I be able to search even if :
Site 1 IDX 1 is down (so the Site 1 is totally HS due to data repartition across the site ?)
Site 2 IDX 1 is down (As I have only one IDX, the site is down)

Am I understand well ?

Best regards,

0 Karma

dxu_splunk
Splunk Employee
Splunk Employee

do u want 1 copy per site?

origin:1,total:2

this puts 1 per site. or equivalently:

origin:1,site1:1,site2:1,total:2

for SF, if you don't want both copies to be searchable, you can do:

origin:1,total:1

(only the source copy will be searchable)

0 Karma

adonio
Ultra Champion

on everything .... origin:1,total:2
OR origin:1 site1:2 total:3 - this will put a copy on each of your indexers
you dont have enough indexers to support more replication than that

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...