Getting Data In

What is the best Site_replication_factor and site_search_factor value to assign multisite indexer clustering?

maniu1609
Path Finder

Hi Team,

We are provided with 5 servers to be configured as indexers. So we're planning to keep 3 indexers in site1 and 2 indexers in site2.

So what is the best Site_replication_factor and site_search_factor value I can mention in cluster master?
Please give me little bit explanation if possible. That could be good learning to me.

Thanks in advance!!

0 Karma
1 Solution

amitm05
Builder

@maniu1609

I believe you should once go through -
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitereplicationfactor
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitesearchfactor

These will really help you clear your concept and in taking your decision.

At high level, replication and search factors is a trade off between performance/availability and disk space.
The more you increase on your search and replication factors, the more space you require. So that is certainly a factor to consider if you have a high data ingestion. This has to be calculated against data availability that you want.

For my suggestion to your specific env, taking both disk space and data availability into consideration. I'd say -
site_replication_factor = origin:2,total:3
site_search_factor = origin:1,total:2

This would mean that for :
replication factor - your data origin site will always have 2 copies and 1 copy with the other site. There will be a total of 3 copies always across the 2 sites.
search factor - your data origin site will always have 1 searchable copy and 1 copy with the other site. There will be a total of 2 copies always across the 2 sites.

Please accept as answer and upvote if this helps. Thanks.

View solution in original post

amitm05
Builder

@maniu1609

I believe you should once go through -
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitereplicationfactor
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitesearchfactor

These will really help you clear your concept and in taking your decision.

At high level, replication and search factors is a trade off between performance/availability and disk space.
The more you increase on your search and replication factors, the more space you require. So that is certainly a factor to consider if you have a high data ingestion. This has to be calculated against data availability that you want.

For my suggestion to your specific env, taking both disk space and data availability into consideration. I'd say -
site_replication_factor = origin:2,total:3
site_search_factor = origin:1,total:2

This would mean that for :
replication factor - your data origin site will always have 2 copies and 1 copy with the other site. There will be a total of 3 copies always across the 2 sites.
search factor - your data origin site will always have 1 searchable copy and 1 copy with the other site. There will be a total of 2 copies always across the 2 sites.

Please accept as answer and upvote if this helps. Thanks.

maniu1609
Path Finder

Thanks @amitm05 for your help. I'm happy that you have given me a direction. I'm clear with Site_replication_factor and site_search_factor value now.

So having odd number of indexers in site1 and even number of indexers in site2 isn't an issue. But we should be careful in choosing Site_replication_factor and site_search_factor. Am i correct?

0 Karma

amitm05
Builder

yes thats correct understanding.
Glad that it helped. Can you accept this as an answer please.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...