during a site failure, lets say site2, indexing may pause for a bit (when useAck=true) since the site2 is not going to be able to receive data (for both data being forwarded directly to site2, as well as replicated data coming from site1).
after a short time (generally some replication/hb timeout or before that), the replicated data from site1 will give up (the hot buckets will roll), and new data going into site1 will not be replicated into site2, and normal site1 ingestion will continue. (internally, we'll start making hot buckets w/o a replicated copy onto site2, so that useAck=true won't block us since its not trying to replicate to site2... when site2 comes back up, the cluster master will start up replication jobs to ensure we meet our site policies and fill in missing buckets on site2)
be aware that on startup, the cluster will wait until the required number of indexers are up per site before the cluster starts indexing. if you start up a multisite cluster but do not start up one of its' sites, indexer-clustering wont begin. see https://answers.splunk.com/answers/209141/why-am-i-getting-error-indexing-not-ready-fewer-th.html and http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Restartindexing
... View more