Deployment Architecture

Multisite Indexer Clustering: How to configure site_replication_factor for two sites so site2 has its own data and a copy of site1, but have site1 only have its own data?

j4adam
Communicator

Hi all,

I'm demoing out a setup with two sites, but the only thing site 2 has is an Indexer. The only purpose of the second site's indexer is disaster recovery. The idea is that I want site 2 (IDX2) to have a copy of itself and site 1 (IDX1). However, I only want site 1 to have its own data and not a copy of site 2.

I've been playing around with site_replication_factor and the I think the secret lays in the origin, but I'm really having a hard time wrapping my head around it.

Thanks for any information you can provide!

lguinn2
Legend

You can't do it with the search and replication factors.

The best solution is "don't forward any data to site2 indexers." Make sure your forwarders are only sending data to site1 indexers.
If you aren't forwarding any data to site2, it will not be the origin for any data - and so it won't have anything to replicate, regardless of the settings.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...