Deployment Architecture

Splunk Multisite Clustering

nehadoshi89
New Member

Hi,

I had a question about setting up a multisite cluster. I have two sites: site1 and site2. Per site we have one indexer each and one search Head each. We have one master node say in site one. Can this architecture be used to configure a multisite architecture? I need a replication factor of 2 and search factor of 2. So I had site replication_factor=origin:1,total:2. But this does not work. Any help on this?

Thanks.

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

So you have 2 sites and one indexer in each site. Sure, this will work with origin:2,total:2 settings. What exactly do you mean by this doesn't work? Did you get an error message?

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

Ok. It may be due to the fact that you have 1 indexer on each site but the (default) legacy replication factor is 3. Add the following to your config and restart master

replication_factor=1
search_factor=1

If this still doesn't work, could you post the error messages from splunkd log files?

0 Karma

nehadoshi89
New Member

Thank you. I tried origin:1, total:2 but the master node did not start up. If I try origin:2, total:3, then it says that search factor and replication factor not met because we do not have equivalent number of peers.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...