In a multisite cluster, Splunk’s replication placement logic doesn’t really optimize based on link speed or latency. It follows the site replication or search factor rules and the bucket copies available, not network topology awareness. The usual approach is to design the site configuration so copies are distributed in a way that matches your network layout. If you have very uneven links, you may need to rethink the site architecture rather than rely on Splunk to pick the “closest” peer.   There isn’t a simple setting that forces site1 to always pull from the fastest site2 peer instead of site3. Network optimization usually comes from proper capacity planning, site definitions, and ensuring the desired copies exist where you need them. ... View more