Splunk Search

multisite replication factor

tvernick
Engager

I have another site I want to add with 2 indexers and 1 search, same setup as site1.
I want to have copies across both clusters so if my original 2 indexers go down, I want the second site to have all data.
Would this work?

site_replication_factor = origin:2,total:4
site_search_factor = origin:1,total:2

Tags (1)
0 Karma

gfreitas
Builder

Yes, with this conf you will have copy of data on each of your Indexers.
To make sure you have a searchable copy of data on both sites you can change your site_search_factor to:

site_search_factor = origin:1, site1:1,site2:1

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...