We have multisite indexer cluster spanning across 2 DCs, one on west coast and another on east coast. I am now working on the project to move from a single search head to multisite search head cluster setup. I have trouble understanding what the benefit of turning off the search affinity in the SHC really is. My understanding is that search affinity reduces traffic between sites because search heads only get results from indexers on their local site, meaning searches can run faster? (Ref: https://docs.splunk.com/Documentation/Splunk/8.2.2/Indexer/Multisitesearchaffinity) However, this SHC documents, https://docs.splunk.com/Documentation/Splunk/8.2.2/DistSearch/DeploymultisiteSHC, recommends turning search affinity off so that: Search heads run searches across indexers spanning all sites If, instead, you set different search heads to different sites, the end user might notice lag time in getting some results, depending on which search head happens to run a particular search. Well, wouldn't turning off search affinity make searches run slower if a search head gets results it needs from an indexer from another site? It sounds to me like these 2 documentations contradict each other, unless I'm missing something.
... View more
