Deployment Architecture

Why replication factor is not met and search head only shows localhost in Splunk Enterprise 6.1.3 multi-site cluster?



I am testing Splunk Enterprise Multi-Site Cluster in my lab. The details of which are mentioned below :

Site1 - Master , Index Peers 1 and 2 , Search Head , and 1 Universal Forwarder.
Site2 - Index Peers 1 and 2, Search Head, and 2 Universal Forwarders.

mode = master
multisite = true
site_replication_factor = origin:2,site1:1,site2:1,total:4
site_search_factor = origin:2,site1:1,site2:1,total:3

I am facing 2 issues :

1 - If I am checking logs on the other Search Head when the one in the site goes down , I am able to find those logs but , the name of the host from which the logs have come is shown as localhost.

(I have proper DNS setup for both the sites.)

2 - My Master says that the replication factor has not been met.

Please let me know if i have goofed up configuration or my assumptions are not right for a 2 site Multi-Cluster configuration. Aslo please let me know if any additional information is needed.

CentOS 6.3
Splunk - 6.1.3 and splunkforwarder 6.1.3

0 Karma

  1. Kindly confirm/recheck in server.conf servername field. serverName = $HOSTNAME

2 . Make sure all the instances have / must have unique guId value in in instance.cfg
guid = B58A86D9-DF3D-4BF8-A426-DB85C231B699

0 Karma

Engager is the answer to my 1st question.

Will try the solution for Ques #2 and update.


Splunk Employee
Splunk Employee

For #2: try setting replication_factor=2. You may have old buckets that were created before multisite - and those follow a different set of rules than that of multisite buckets.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!