Splunk Search

What values should I use for replication and search factor in a Splunk multisite indexer cluster with one peer in site1 and two peers in site2?

hettervik
Builder

Hi!

I'm trying to configure a multisite indexer cluster with two sites; site1 and site2. There are one peer in site1, and two peers in site2. I don't think I quite grasp the concept of replication_factor and search_factor vs. site_replication_factor and site_search_factor. I want to set both site_replication_factor and site_search_factor to origin:1,total:2, and in that way keep one copy on the original site, and one on the other site. Also, I want to have the copies fully searchable, so I have to set replication_factor=2 and search_factor=2, right? When I use these values (see code sample below) I get Search Factor is Not Met and Replication Factor is Not Met errors, while when using replication_factor=1 and search_factor=1 everything seems fine. What does this mean using these values considering replication and search? any help would be much appreciated! 🙂


server.conf on master:

[clustering]
available_sites = site1,site2
mode = master
multisite = true
pass4SymmKey = $1$/UusYBk6nI5J
replication_factor = 2
search_factor = 2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:2
Tags (1)
0 Karma
1 Solution

mahamed_splunk
Splunk Employee
Splunk Employee

In multisite env site_replication_factor and site_search_factor are in use. The legacy replication_factor and search_factor are meant for single site cluster. You can leave these single site values as 1.

To achieve 2 searchable copies in your multisite env, your current setting is accurate.

site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:2

View solution in original post

mahamed_splunk
Splunk Employee
Splunk Employee

In multisite env site_replication_factor and site_search_factor are in use. The legacy replication_factor and search_factor are meant for single site cluster. You can leave these single site values as 1.

To achieve 2 searchable copies in your multisite env, your current setting is accurate.

site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:2

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...