Knowledge Management

Could someone tell us about the introduction of SmartStore only for a site of multi site cluster?

skasagawa
Explorer

My Customer have a multi-site cluster (site1, site2), and they are considering introducing a new site3.
They are considering introducing the SmartStore only to this site3 indexer cluster.
We think that it is necessary to describe the setting of SmartStore in "Local" of the indexer of site3 instead of distribution from the cluster master, because the SmartStore only to site3 indexer cluster.

Please tell us about the introduction of SmartStore in a multi-site cluster.

Also, RF and SF values must be the same when introducing the SmartStore, we think it is necessary to change the current settings as follows.

[Current setting]

 

 

# Multi site settings
multisite = true
available_sites = site1, site2
site_replication_factor = origin:3, site2:2, total:5
site_search_factor = origin:2, site2:1, total:3

 

 

[After changing the settings]

 

 

# Multi site settings
multisite = true
available_sites = site1, site2, site3
site_replication_factor = origin:3, site2:2, site3:2, total:7
site_search_factor = origin:2, site2:1, site3:2, total:5

 

 

Please tell us anything else we should be careful about these case.

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...