What is the difference for Replication Factor between single vs multi site?

[giulioBalza]

Hello,

i have a big doubt about the RF behavior about single and multi site cluster.

When a single site is used an hypothetical configuration: Replication Factor=2 is quite easy i have two copies of the same data in the site (originating + copy). And only one peer can goes down

In a multi site (example two sites) if i understood, with: 

-  site_replication_factor = origin:1,site1:1,site2:1,total:2 - there are two copies (originating site=1 other site=1). Only one peer can be down, is it in total or one at site ?

-   site_replication_factor = origin:2,site1:1,site2:1,total:3 - there are three copies (originating site=2 other site=1)  Only two peer scan be down, is it in total or two at site ?

Using   site_replication_factor = origin:1,site1:1,site2:1,total:2 means that if i loss the peer in originating site the SHs redirect query to the second site (SF=2) ?

Thanks

[PickleRick · Accepted solution]

There is no such thing as "a peer can go down". It's not a RAID so you don't need to have some subset of your data to calculate other parts of it. For the data to be available you need to have at least one searchable bucket. This is called a valid cluster.

But splunk will try to meet the replication and search factors so if there is not enough copies of each bucket, it will try to replicate the buckets according to the declared factors. If all buckets meet the factors, the cluster is complete.

So you can have several peers down and still have your cluster valid but it might not be complete.

There is additional issue with sites regarding SH. In a "normal" scenario, SHs search only in their own site. You must have them defined "siteless" (in a special site0) to be able to search across all sites.

[giulioBalza]

Hello Rick,

sorry for delay, your answer is what i need.

Thanks

Giulio