Getting Data In

What is the best Site_replication_factor and site_search_factor value to assign multisite indexer clustering?

Path Finder

Hi Team,

We are provided with 5 servers to be configured as indexers. So we're planning to keep 3 indexers in site1 and 2 indexers in site2.

So what is the best Sitereplicationfactor and sitesearchfactor value I can mention in cluster master?
Please give me little bit explanation if possible. That could be good learning to me.

Thanks in advance!!

0 Karma
1 Solution

Builder

@maniu1609

I believe you should once go through -
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitereplicationfactor
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitesearchfactor

These will really help you clear your concept and in taking your decision.

At high level, replication and search factors is a trade off between performance/availability and disk space.
The more you increase on your search and replication factors, the more space you require. So that is certainly a factor to consider if you have a high data ingestion. This has to be calculated against data availability that you want.

For my suggestion to your specific env, taking both disk space and data availability into consideration. I'd say -
sitereplicationfactor = origin:2,total:3
sitesearchfactor = origin:1,total:2

This would mean that for :
replication factor - your data origin site will always have 2 copies and 1 copy with the other site. There will be a total of 3 copies always across the 2 sites.
search factor - your data origin site will always have 1 searchable copy and 1 copy with the other site. There will be a total of 2 copies always across the 2 sites.

Please accept as answer and upvote if this helps. Thanks.

View solution in original post

Builder

@maniu1609

I believe you should once go through -
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitereplicationfactor
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitesearchfactor

These will really help you clear your concept and in taking your decision.

At high level, replication and search factors is a trade off between performance/availability and disk space.
The more you increase on your search and replication factors, the more space you require. So that is certainly a factor to consider if you have a high data ingestion. This has to be calculated against data availability that you want.

For my suggestion to your specific env, taking both disk space and data availability into consideration. I'd say -
sitereplicationfactor = origin:2,total:3
sitesearchfactor = origin:1,total:2

This would mean that for :
replication factor - your data origin site will always have 2 copies and 1 copy with the other site. There will be a total of 3 copies always across the 2 sites.
search factor - your data origin site will always have 1 searchable copy and 1 copy with the other site. There will be a total of 2 copies always across the 2 sites.

Please accept as answer and upvote if this helps. Thanks.

View solution in original post

Path Finder

Thanks @amitm05 for your help. I'm happy that you have given me a direction. I'm clear with Sitereplicationfactor and sitesearchfactor value now.

So having odd number of indexers in site1 and even number of indexers in site2 isn't an issue. But we should be careful in choosing Sitereplicationfactor and sitesearchfactor. Am i correct?

0 Karma

Builder

yes thats correct understanding.
Glad that it helped. Can you accept this as an answer please.

0 Karma