Splunk Search
Highlighted

Multi-Site Cluster: What would I configure for replication and search factor with 1 peer at each site?

Communicator

Hi all,

Am planning a multi-site (2 datacenters) installation of Splunk Enterprise v6.1.3. It will include Enterprise Security if that changes anything.

There will be 1 SH per-DC, 1 IDXer per-DC, 1 HFWer per-DC (configured with a RF=2 SF=2)

Both SHs will be configured for distributed-search across the indexers at each site.

Will there be any issues having one side of the deployment in another DC with a higher-RTT than the local indexer?

I'm wondering whether to bother with using a 'multi-site' cluster mainly to make use of the search-affinity feature, but what would i configure for the sitereplicationfactor and sitesearchfactor when there is only 1 peer at each site?

Hoping someone could help clarify. I'm a little unclear on this..

Thanks.

Highlighted

Re: Multi-Site Cluster: What would I configure for replication and search factor with 1 peer at each site?

Contributor

Yes, you can have one peer / site. The configuration to use is

sitereplicationfactor = origin:1,total:2

sitesearchfactor = origin:1,total:2

This states that keep 1 copy of the data in the origin site and another copy at some other site

Highlighted

Re: Multi-Site Cluster: What would I configure for replication and search factor with 1 peer at each site?

Communicator

I get this error with the above factors on my master-node in site1:

09-20-2014 20:41:02.611 +1000 ERROR ClusteringMgr - Failure to load cluster config (server.conf) Error = sitereplicationfactor={ origin:1, total:2 } is less than replication_factor=3.

I'm thinking i do need a minimum of 3 peers (or more) for multi-site?

Thanks.

0 Karma
Highlighted

Re: Multi-Site Cluster: What would I configure for replication and search factor with 1 peer at each site?

Contributor
Highlighted

Re: Multi-Site Cluster: What would I configure for replication and search factor with 1 peer at each site?

Builder

The way I understand it, when the number of peers in any site is lower than the default replicationfactor and searchfactor values, 3 and 2 respectively, you'll have to set replicationfactor and searchfactor.

From the answer above, add the two following lines:

replicationfactor = 1
search
factor = 1

In addition to:

sitereplicationfactor = origin:1,total:2
sitesearchfactor = origin:1,total:2

Highlighted

Re: Multi-Site Cluster: What would I configure for replication and search factor with 1 peer at each site?

Path Finder

correct, needed

replicationfactor = 1
search
factor = 1

in addition to

sitereplicationfactor = origin:1,total:2
sitesearchfactor = origin:1,total:2

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.