Getting Data In

Multi sites indexers without the same number of peers

davidf_bkk
New Member

Hello,

I currently have a multi site clustering.

Our architecture have 2 sites, and these 2 sites don't have the same number of indexers :

Site 1 : 2 indexers (200 Gb each)
Site 2 : 1 indexer (400 Gb)

My configuration is the following :

site_replication_factor = origin:1,site1:1,site2:1,total:2
site_search_factor = origin:2,site1:1,site2:1,total:2

But by doing this, I seem that a data redudancy occur on site 1,

For example I have an index which is limited to 15Gb :
Site1 : idx1 : full (15gb/15gb)
Site1 : idx2 : full (15gb/15gb)
Site2 : idx1 : full (15gb/15gb)

With a replication factor of 2, shouldn't be like this ? =>
Site1 : idx1 : half (7.5gb/15gb)
Site1 : idx2 : half (7.5gb/15gb)
Site2 : idx1 : full (15gb/15gb)

Of course, I want the data replicated between site 1 and 2. I have only one search head on site 1.

If I try the following :

replication_factor = 2
search_factor = 1

What happen ? Should I be able to search even if :
Site 1 IDX 1 is down (so the Site 1 is totally HS due to data repartition across the site ?)
Site 2 IDX 1 is down (As I have only one IDX, the site is down)

Am I understand well ?

Best regards,

0 Karma

dxu_splunk
Splunk Employee
Splunk Employee

do u want 1 copy per site?

origin:1,total:2

this puts 1 per site. or equivalently:

origin:1,site1:1,site2:1,total:2

for SF, if you don't want both copies to be searchable, you can do:

origin:1,total:1

(only the source copy will be searchable)

0 Karma

adonio
Ultra Champion

on everything .... origin:1,total:2
OR origin:1 site1:2 total:3 - this will put a copy on each of your indexers
you dont have enough indexers to support more replication than that

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...