Deployment Architecture

Multisite Indexer Clustering: How to configure site_replication_factor for two sites so site2 has its own data and a copy of site1, but have site1 only have its own data?

j4adam
Communicator

Hi all,

I'm demoing out a setup with two sites, but the only thing site 2 has is an Indexer. The only purpose of the second site's indexer is disaster recovery. The idea is that I want site 2 (IDX2) to have a copy of itself and site 1 (IDX1). However, I only want site 1 to have its own data and not a copy of site 2.

I've been playing around with site_replication_factor and the I think the secret lays in the origin, but I'm really having a hard time wrapping my head around it.

Thanks for any information you can provide!

lguinn2
Legend

You can't do it with the search and replication factors.

The best solution is "don't forward any data to site2 indexers." Make sure your forwarders are only sending data to site1 indexers.
If you aren't forwarding any data to site2, it will not be the origin for any data - and so it won't have anything to replicate, regardless of the settings.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...