Splunk Enterprise

What is the difference for Replication Factor between single vs multi site?

giulioBalza
Path Finder

Hello,

i have a big doubt about the RF behavior about single and multi site cluster.

When a single site is used an hypothetical configuration: Replication Factor=2 is quite easy i have two copies of the same data in the site (originating + copy). And only one peer can goes down

In a multi site (example two sites) if i understood, with: 

-  site_replication_factor = origin:1,site1:1,site2:1,total:2 - there are two copies (originating site=1 other site=1). Only one peer can be down, is it in total or one at site ?

-   site_replication_factor = origin:2,site1:1,site2:1,total:3 - there are three copies (originating site=2 other site=1)  Only two peer scan be down, is it in total or two at site ?

Using   site_replication_factor = origin:1,site1:1,site2:1,total:2 means that if i loss the peer in originating site the SHs redirect query to the second site (SF=2) ?

Thanks

 

Labels (1)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

There is no such thing as "a peer can go down". It's not a RAID so you don't need to have some subset of your data to calculate other parts of it. For the data to be available you need to have at least one searchable bucket. This is called a valid cluster.

But splunk will try to meet the replication and search factors so if there is not enough copies of each bucket, it will try to replicate the buckets according to the declared factors. If all buckets meet the factors, the cluster is complete.

So you can have several peers down and still have your cluster valid but it might not be complete.

There is additional issue with sites regarding SH. In a "normal" scenario, SHs search only in their own site. You must have them defined "siteless" (in a special site0) to be able to search across all sites.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

There is no such thing as "a peer can go down". It's not a RAID so you don't need to have some subset of your data to calculate other parts of it. For the data to be available you need to have at least one searchable bucket. This is called a valid cluster.

But splunk will try to meet the replication and search factors so if there is not enough copies of each bucket, it will try to replicate the buckets according to the declared factors. If all buckets meet the factors, the cluster is complete.

So you can have several peers down and still have your cluster valid but it might not be complete.

There is additional issue with sites regarding SH. In a "normal" scenario, SHs search only in their own site. You must have them defined "siteless" (in a special site0) to be able to search across all sites.

0 Karma

giulioBalza
Path Finder

Hello Rick,

sorry for delay, your answer is what i need.

 

Thanks

Giulio

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...