international site best practices

[earixson]

WE have two small international sites. What's the best practice for getting that data into our main SPlunk here in the U.S.? Our main concern is bandwidth usage.

Should we have an indexer at each site as detailed int eh Multi-Site cluster doc?
should we first try using the compression on the data flowing back to the US?

WE have an enterprise license, BTW.

[mahamed_splunk]

It depends on what your end goal is. For eg, you could have an indexer in your international site and have all your international forwarders send the data to that indexer. From there onwards the multisite clustering can take over and replicate the data to the US side.

The other way would be to have your international forwarders send the data to US indexers directly, eliminating the need to have an indexer in international site.

Irrespective of the options, the data needs to be transferred over the WAN. So it mainly depends on the amount of data and your network speed.