How to migrate a single site to multiple?

[TISKAR]

Hello Splunker

I want to migrate a single cluster that contains three multisite cluster indexes.

For the Single Site: I have 2 search Factory and 2 replicate Factory.

and I want to keep the same configuration (2 search Factory and 2 Replicate Factory).

For the migration, is the following correct syntax?

   splunk edit cluster-config -mode master -multisite true -site site1 -available_sites site1,site2                              -site_replication_factor origin:1,total:2 -site_search_factor origin:1,total:2 -replication_factor 2 -search_factor 2                -secret secret

Thank you

[ddrillic]

The command you posted is for the cluster master and then you need to adjust each indexer and SH.

All looks good in the command itself and we just had a discussion about this topic at What’s the relation between the site_replication_factor and replication_factor in a multisite indexe...

[TISKAR]

Thank you @ddrillic
splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:1,site1:2,site2:1,total:3 -site_search_factor origin:1,total:2 -replication_factor 1 -search_factor 1

after the migration the site 2 indexer3 receives the replication data, but the site 2 indexer2 does not receive the data.
I have to delete earch_factor=1 and replication_factor=1 after migration.

Thank you for your return

[skalliger · Accepted solution]

Hi,

so, when you want to keep the existing RF and SF, why do you want to migrate to a multisite cluster?

The command you have posted just puts the Cluster Master into a multisite CM. After that, you still need to assign every peer a site.

Next to your SF and RF you should think about site_replication_factor and site_search_factor.

Keep in mind, when you change from single-site to multisite with the same amount of peers AND you split them into different sites, your actual SF and RF can never be met (numbers of peers in a site must be equal or greater than SF and RF).

Follow the steps mentioned in the docs: https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Migratetomultisite

Skalli

[TISKAR]

Thank you @skalliger for this response,

So i must change the replication factory ans search Factory to 1, 1 Like this:

splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:1,total:2 -site_search_factor origin:1,total:2 -replication_factor 1 -search_factor 1 –secret secreter

in the doc Splunk they say at first

Do not remove the existing single-site attributes for replication factor and search factor, replication_factor and search_factor. The master needs them to handle the migrated buckets.

And then In my case i must change the replication and search Factory to 1, because i have two indexer in site1 and one indexer in site2:

If the number of peers on any site is less than the single-site replication_factor or search_factor, you must reduce the values of those attributes to match the least number of peers on any site. For example, if replication_factor is 3 and search_factor is 2, and one of the sites has only 2 peers, you must change replication_factor to 2. Otherwise, the migrated buckets might not meet the replication and search factors, due to the way the cluster replicates migrated buckets. See Multisite cluster does not meet its replication or search factors. 

So i change the replication factory?

[skalliger]

It's called Replication Factor and Search Factor by the way. 🙂

My question still persists, why do you want to migrate to a multisite cluster?

Actually, your site with two indexers can keep an SF and RF 2. But your new site needs an SF and RF of 1 due to having only one indexer.

Skalli

[TISKAR]

Thank you,

Why i want multsite? because i want limit SH in two indexer, i don't want use indexer3 in SH

I have a question, in my case i can't use repfactory=2 and search factory=2. So i must use repfactory=1 and search factory=1, OK.

in this case the SH use only one indexer in the Search, it's that correct?

[skalliger]

Asking for the problem first has its reasons. 🙂

What you want to do doesn't necessarily require a multisite cluster. When you want to restrict the search head to two of the indexers only, you can easily do this: Don't use indexer discovery and manually define both indexers under distributed search in settings. This way, your third indexer won't be searched by the SH. Docs page: https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Configuredistributedsearch

But to answer your question: yes, you can do RF2/SF2 on one site and RF1/SF1 on the second site. If you want to do this, you need to enable search affinity however so that your SH will not search the single indexer on site2.

Skalli

[skalliger]

If your problem got solved to your satisfaction, you may accept this as your answer.

Skalli