I have a multisite cluster with 2 sites and 2 indexers per site. I'm receiving the following error on the cluster master: site_replication_factor={ origin:1, total:2 } is less than replication_factor=3 The config in server.conf is: [clustering] mode = master multisite = true available_sites = site1,site2 site_replication_factor = origin:1,total:2 site_search_factor = origin:1,total:2 Now I think the solution to this is to set the 'replication_factor = 2' as if I set this it all works without error. But within Splunk documentation it states that 'site_replication_factor' should be "in place of" 'replication_factor'. Is this because the default replication factor is 3 and because I have omitted it (as per documentation) it's defaulting to 3? Can someone confirm if this is a bug or just a documentation error? Thanks. Working Config: [clustering] mode = master multisite = true available_sites = site1,site2 site_replication_factor = origin:1,total:2 site_search_factor = origin:1,total:2 replication_factor = 2 Link: http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Sitereplicationfactor ... View more

Hi Team, I have a brand new Splunk implementation. Both SH Cluster and IX Cluster are setup and supported by a Deployer and Cluster Master respectively. The SH Cluster is forwarding all data to the IX Cluster along with UFs etc. I'm now at the stage where ES need to be installed, I have found the documentation to install a ES into a new implementation very minimal and confusing with regard to a clustered environment. Do I just need to add the ES app to the Deployer (/apps/enterprise_security) which will install on the SHs within the cluster, then install the relevant ES app onto the Cluster Master (/master-apps/enterprise_security) to install it on all IXs? Thanks for your help. ... View more