What I need to deploy clustered indexes on different nodes. I want to get 3 clusters of 2 nodes each with the ability to search in all clusters from one search head.
You want a multi-site cluster. See https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Multisitedeploymentoverview.
You want a multi-site cluster. See https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Multisitedeploymentoverview.
Thanks for the answer.
As far as I understand, in a multisite, data is replicated between sites. I need 3 clusters without replication between the clusters, but with the ability to search on all the clusters with one search head.
It is typical for multi-site clusters to replicate data between sites, but you don't have to do so.
What are the index.conf and server.cong settings for this? There is no node selection in the index settings.
In server.conf, site_replication_factor = origin:2, total:2
will keep all copies in the originating site.
If a single node is unavailable in a site, will the index be replicated to a neighboring site? How to avoid it.