Deployment Architecture

multisite site cluster - "Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor."

brent_weaver
Builder

I am configuring a multisite cluster and am confused by this error message. I have 2 sites and 4 nodes. The error message does not make sense. "total should be greater than or equal to replication_factor." Any help is MUCH appreciated.

splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:1,total:2 -site_search_factor origin:1,total:1
Your session is invalid.  Please login.
Splunk username: brent
Password:
Invalid site_replication_factor, Reason: total should be greater than or equal to replication_factor.
0 Karma

saravanan90
Contributor

Run the below command & update the replication_factor, site_replication_factor manually in server.conf as below.

splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:2,total:3 -site_search_factor origin:1,total:2

[clustering]
mode = master
multisite = true
available_sites = site1,site2
site_replication_factor = origin:1,total:2
site_search_factor = origin:1,total:2
replication_factor = 2

Refer the below link.
https://answers.splunk.com/answers/294071/indexer-cluster-error-site-replication-factor-orig.html

0 Karma

kartm2020
Communicator

Can you please try the below command
splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:2,total:3 -site_search_factor origin:1,total:2

0 Karma

brent_weaver
Builder

Thanks for the response, i already did that and it worked. But to me that seems that I will have a two coopes on origin, is that not the case?

0 Karma

kartm2020
Communicator

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/MultisiteCLI

When comes to the multisite cluster. You have to go with the default value and you cant reduce it. but you can increase it.

0 Karma

brent_weaver
Builder

When you say "the default value" what do you mean. This has always confused me about splunk. I would assume origin:1,total:2 would leave one bucket on origin and copy another to the other site. Is this NOT the case?

0 Karma

kartm2020
Communicator

From your command it says total is 2. But your replication factor is 3. Replication factor is different from site replication factor.
The site_replication_factor replaces the standard replication_factor used with single-site clusters.
So it is not taking. If you have 3 nodes in your environment then it might get work.
If you are not setting any rep factor. by default it will take as origin:2,total:3.
Hope i have answered your question. Please let me know for more clarification.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitereplicationfactor

0 Karma

brent_weaver
Builder

So lets try it this way. I have a 2 site cluster, 2 nodes in site one and two nodes in site two. I want one bucket to go to one site, and another to go to the other site. Will this config accomplish that?

0 Karma

kartm2020
Communicator

No it wont. Because you have 4 nodes with rep factor of 3. total should always greater than or equal to rep factor. In your command you have written the total as 2. thats the reason it showing an error "total should be greater than or equal to replication_factor"

0 Karma

brent_weaver
Builder

Ok so what am I missing here? How do I put one bucket on origin and one on the other site?

0 Karma

kartm2020
Communicator

Sorry for the late response. You are putting total as 3. Can you please put origin as 1 and total as 4. It might get work. Please let me know about the status.

0 Karma

kartm2020
Communicator

Hope I answered your question.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...