can i get a example for props.conf & transforms.conf for multiple host automatic lookup setup ... View more

You could found the explanation from here  https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/AboutSHC https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCandindexercluster If/when your SHCs have different roles then you are needing own Deployers for both, don't use the same Deployer instance if content of those SHCs are different. It's hard to give to you any detailed explanations about your environment without more knowledge of it. And as I said, basically you have too many SHC members (SHs) vs. Indexer peers. That is something which I cannot understand with your current information.   ... View more

Hi what is the purpose of your multisite cluster? To answer this usually tolds what to put on SF and RF values also we should known how many peers you have on each site. Personally I use SF&RF like #sites as total when # sites >=3 (otherwise like SF=2 and RF=3 or RF=2). But if you have lot of sites then it's probably not needed to increase SF&RF until it reach #sites. Especially if you are using SmartStore those must be equal. IMHO the only reason to use bigger SF&RF is when you have unreliable HW which crash/go down regularly and this generates need to rebuild those buckets. But also in that cases you should fix you HW instead of just increasing SF&RF. To increasing peers on sites gives you a better search performance when you buckets have speared equally over peers. In your cases I just change RF=SF=3 and just add needed amount of new peers to those sites. Especially no need to increase those. If/when your multisite cluster is on AWS with 3AZ then you should consider to take SmartStore (S3 buckets) into use if your searches are mostly covered 1-3month time and you can add enough cache. r. Ismo   ... View more

Since there is no such thing as a "standard" indexer multi-site cluster, there are no "standard" site search and replication factor settings. See https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Sitereplicationfactor . A search head cluster is different.  SHCs are not site-aware and are not HA. ... View more