Hi Splunkers, I recently encountered a requirement to expand our existing multisite indexer cluster. We need to add new sites and deploy search heads in the new sites. These search heads must join the existing search head cluster, but each site’s search heads should only search data stored locally in their own site. Current Cluster Manager (Master) Configuration [general] site = site0 [clustering] available_sites = site5,site6,site7,site8 mode = master multisite = true pass4SymmKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX site_replication_factor = origin:1,site8:1,total:2 site_search_factor = origin:1,site8:1,total:2 rebalance_threshold = 0.9 cluster_label = eg_idxc maintenance_mode = false site_mappings = site1:site8,site2:site6,site3:site7,site4:site5 constrain_singlesite_buckets = false replication_factor = 2 Planned Changes We plan to add site9, site10, site11, and site12. Site12 must also store a copy of the data. The updated Cluster Manager configuration​ will be: [general] site = site0 [clustering] available_sites = site5,site6,site7,site8,site9,site10,site11,site12 mode = master multisite = true site_replication_factor = origin:1,site8:1,site12:1,total:3 site_search_factor = origin:1,site8:1,site12:1,total:3 rebalance_threshold = 0.9 cluster_label = eg_idxc maintenance_mode = false site_mappings = site1:site8,site2:site6,site3:site7,site4:site5 constrain_singlesite_buckets = false replication_factor = 3 Indexer Expansion (Example: site12) Add indexer peers to the multisite cluster: splunk edit cluster-config -mode peer -site site1 -manager_uri https://$CM_IP$:8089 -replication_port 9887 -secret $cluster_secret_password$ Search Head Expansion (New Site Search Heads) Initialize Search Head Cluster Config： splunk init shcluster-config -auth <username>:<password> -mgmt_uri <URI>:<management_port> -replication_port <replication_port> -replication_factor <n> -conf_deploy_fetch_url <URL>:<management_port> -secret <security_key> -shcluster_label <label> Join the Existing SHC and Bind to site12： splunk edit cluster-config -mode searchhead -site site12 -master_uri https://$CM_IP$:8089 -secret $cluster_secret_password$ -auth login:password If anyone has suggestions or sees potential issues with this approach—especially around site affinity behavior​ or search factor design—please let me know. Thanks in advance! ... View more

Hello Splunkers, I've been having issues with Dashboard Studio lately that have been bothering me. I'd really appreciate any advice. I want to assign different colors to data based on different field values—green for "normal", yellow for "warning", and red for "critical". I've tried the following configurations, but none of them have worked. { "type": "splunk.map", "options": { "center": [ 34.266, 108.945 ], "zoom": 2.3155822324586683, "layers": [ { "seriesColors": [ "#00FF00", "#FFFF00", "#FF0000", "bubbleSize": "> primary | frameBySeriesNames('normal','warning','critical')" } ] }, "dataSources": { "primary": "ds_PHhx1Fxi" }, "context": {}, "showProgressBar": false, "showLastUpdated": false } chenfan_0-1767073833477.png   ... View more

Hello Splunkers, I've been having problems with Dashboard Studio recently and it has been bothering me for a long time. It would be great if you could give me some suggestions. I want to assign different colors according to different field values. I have made the following configurations, but they haven't taken effect. { "type": "splunk.map", "options": { "center": [ 24.007647480837704, 107.43997967141127 ], "zoom": 2.3155822324586683, "showBaseLayer": true, "layers": [ { "type": "bubble", "latitude": "> primary | seriesByName('latitude')", "longitude": "> primary | seriesByName('longitude')", "bubbleSize": "> primary | frameWithoutSeriesNames('_geo_bounds_east', '_geo_bounds_west', '_geo_bounds_north', '_geo_bounds_south', 'latitude', 'longitude') | frameBySeriesTypes('number')", "dataColors": " > primary | seriesByName('status') | matchValue('colorMatchConfig')" } ] }, "dataSources": { "primary": "ds_PHhx1Fxi" }, "context": { "colorMatchConfig": [ { "match": "high", "value": "#FF0000" }, { "match": "low", "value": "#00FF00" }, { "match": "critical", "value": "#0000FF" } ] }, "containerOptions": {}, "showProgressBar": false, "showLastUpdated": false }   ... View more