We are deploying a new instance of Splunk Enterprise and have decided on a multisiteclusterarchitecture for high availability and disaster recovery. Unfortunately, we are getting our hardware r...
Hello Splunk Gurus,
I have a multisiteindexing cluster in Splunk 6.6.1 spanning two sites: small & big.
The "big/site1" site is configured with RF=3/SF=2.
Due to having way less disk, t...
I am planning a multisitearchitecture.
I have 3 sites in 3 different locations (different countries across Europe) and the first thing I need is to store local indexed data locally on each s...
I have 2 locations, and not a ton of resources. Multisiteclustering took too much -- it seems like I need at least 3 indexers (or maybe it was 2 per site). But, I only have 2 indexers, so I d...
Hi , I have a multisiteindexercluster (3 sites , 2 indexers each, total 6 indexers) . we have kept - site_replication_factor = origin:2,total:5 site_search_factor = origin:2,t...
Hello all,
I currently have a quite big splunk infrastructure with a multisitecluster (5 sites) each site has two indexer server. Additionally I have a smaller site with a completely i...
...plunk 6.3 with both multisiteclustering and search head clustering
Our review board is suggesting why not 4 copies instead of 6, as in 2, 1, 1 (origin 2, 4 in total)?
Reasons to keep 6 copies of o...
Hi All, I am going to work on a multisitearchitecture (3-sites) where we are keeping 6 indexers in a cluster (2 in each sites) ,and 6 SHs in a cluster (2 in each sites) , 3 SHs in another cluster...
Hi,
I had a question about setting up a multisitecluster. I have two sites: site1 and site2. Per site we have one indexer each and one search Head each. We have one master node say in site one. C...
In our setup we have a searchhead cluster with no search affinity (site0) and a multisiteindexerclusters (site1/site2). Now its time for some expansion and although we already expanded the s...