×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Cloud001
Explorer
Member since: ‎07-16-2024
‎07-17-2024
Community Statistics
Posts 7
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎07-16-2024
Activity Feed
View All

Re: Multisite indexer cluster : Why is data from ...

by in Getting Data In
‎07-17-2024 05:15 PM
‎07-17-2024 05:15 PM
I misunderstood search affinity and misunderstood the purpose of multi-site configuration. Thank you for your kind notice. ... View more

Re: Multisite indexer cluster : Why is data from ...

by in Getting Data In
‎07-17-2024 08:10 AM
‎07-17-2024 08:10 AM
  A. The search results are shown below. B. My goals are as follows 1. site1's SH wants to retrieve only the data that site1's indexer has. 2. site2's SH wants to retrieve only the data that site2's indexer has. 3. site1's indexer stores RAW data from site1 and site2. 4. site2's indexer stores only site2's RAW data.   C. Is it possible to configure the following structure?   D.  server.conf Option 1. On site1_SH, there is no difference between the behavior when server.conf is set to site=site0 and when it is set to site=site1. 2. On site2_SH, there is no difference in behavior between setting server.conf to site=site0 and site=site2.   ... View more

Re: Multisite indexer cluster : Why is data from ...

by in Getting Data In
‎07-16-2024 08:56 PM
‎07-16-2024 08:56 PM
This is a temporary index created for testing purposes. The index is deployed from master. How do I ensure that only my own site's data is retrieved? ... View more

Re: Multisite indexer cluster : Why is data from ...

by in Getting Data In
‎07-16-2024 06:02 PM
‎07-16-2024 06:02 PM
site_replication_factor = origin:3,site1:3,total:6 site_search_factor = origin:2,total:2 ... View more

Re: Multisite indexer cluster : Why is data from ...

by in Getting Data In
‎07-16-2024 05:44 PM
‎07-16-2024 05:44 PM
A search effector exists on each site. How do I ensure that only data from the site the SH belongs to is retrieved?   ... View more

Multisite indexer cluster : Why is data from othe...

by in Getting Data In
‎07-16-2024 04:43 AM
‎07-16-2024 04:43 AM
Why is data from other sites retrieved?  1. splunk version  9.2.1   2. server.conf : manager-node      [general]      serverName = site01_master      pass4SymmKey = $7$50dW7T6+mDkef5xS4o2BemFWDAur04JWlGHTwFKCNHAXuGtkZkOaEg==      site = site1      [clustering]      available_sites = site1,site2      mode = manager      multisite = true      pass4SymmKey = $7$lBUz3IZR3TZJeUAdYDUZR4tesE3AL0ttpupYUywS3UrG7PdwqHZ01g==      site_replication_factor = origin:3,site1:3,total:6      site_search_factor = origin:2,total:2 3. server.conf : site1-SH      [general]      serverName = site01_sh01      pass4SymmKey = $7$lX74ABK5XURidryB9htlMI9hsjjZZSq0PulPOi3bCbCziiWrBBnN5g==      site = site1      [clustering]      manager_uri = https://192.168.79.141:8089      mode = searchhead      multisite = true      pass4SymmKey = $7$JZddW4jKx48TGUx03PmTHexz76aYtTwK/aW7cQ9AGFsnZaA++xv1lA==       3. server.conf : site2-SH      [general]      serverName = site02_sh01      pass4SymmKey = $7$zFcBrd6VgPug9rgiJvI+mvRI5H7PRWwuaGgg0HBY0UKp4hTMN1CBmQ==      site = site2      [clustering]      manager_uri = https://192.168.79.141:8089      mode = searchhead      multisite = true      pass4SymmKey = $7$3u+CM93kvNCnGZolsv6K9EdD6fyYpalpNDyfL/+Bq0D0Vuzd5u3kuQ==     ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎07-17-2024 08:36 PM
Karma given to
View All