Hello,
we would like to setup a multisite indexer cluster with 4 sites (1 to 4).
Two of these sites (1 and 2) should have at least on copy of each bucket replicated and searchable.
The two other sites (3 and 4) should only have a copy of each bucket that originated in that site.
As an example:
+-------------+-------------------------------+
| | min Number of Buckets |
+-------------+-------+-------+-------+-------+
| Origin Site | site1 | site2 | site3 | site4 |
+-------------+-------+-------+-------+-------+
| site 1 | 1 | 1 | 0 | 0 |
+-------------+-------+-------+-------+-------+
| site 2 | 1 | 1 | 0 | 0 |
+-------------+-------+-------+-------+-------+
| site 3 | 1 | 1 | 1 | 0 |
+-------------+-------+-------+-------+-------+
| site 4 | 1 | 1 | 0 | 1 |
+-------------+-------+-------+-------+-------+
My idea would be to use the following configuration:
[clustering]
mode = master
multisite = true
available_sites = site1,site2,site3,site4
replication_factor = 2
site_replication_factor = origin:1,site3:0,site4:0,total:2
site_search_factor = origin:1,site3:0,site4:0,total:2
However it's not possible to set the replication factor of a site to 0 (splunk will throw an error and won't startup)
Do you have any other suggestions how we could setup the system and fulfill the requirements written above?
... View more
