Multisite indexer clusters - Splunk Documentation (original) (raw)

Indexer clusters have built-in site-awareness, meaning that you can explicitly configure a multisite indexer cluster on a site-by-site basis. This simplifies and extends the ability to implement a cluster that spans multiple physical sites, such as data centers.

Use cases

Multisite clusters offer two key benefits over single-site clusters:

• Improved disaster recovery. By storing copies of your data at multiple locations, you maintain access to the data if a disaster strikes at one location. Multisite clusters provide site failover capability. If a site goes down, indexing and searching can continue on the remaining sites, without interruption or loss of data.
• Search affinity. If you configure each site so that it has both a search head and a full set of searchable data, the search head on each site will limit its searches to local peer nodes. This eliminates any need, under normal conditions, for search heads to access data on other sites, greatly reducing network traffic between sites.

Multisite configuration

You configure multisite clusters somewhat differently from basic, single-site clusters. These are the key differences for multisite clusters:

• You assign a site to each node.
• You can specify the replication and search factors on a site-by-site basis. That is, you can specify the number of copies and searchable copies that you want to maintain on each site, along with the number that you want to maintain on the cluster overall.

There are a few other configuration differences as well. See "Multisite deployment overview".

Multisite architecture

The architecture of single-site and multisite clusters is similar. These are the main differences for multisite clusters:

• Each node belongs to an assigned site.
• Replication of bucket copies occurs in a site-aware manner.
• Search heads distribute their searches across local peers only, whenever possible.

For more information on multisite cluster architecture, read "Multisite indexer cluster architecture".

For more information

These chapters and topics describe multisite clusters in detail:

• "Deploy and configure a multisite indexer cluster". This chapter contains topics that describe multisite configuration, including search affinity configuration and multisite replication and search factors.
• "Manage a multisite indexer cluster". This chapter covers issues such as handling manager site failure and converting a multisite cluster to single-site.
• "Migrate an indexer cluster from single-site to multisite". This topic describes how to convert a single-site cluster to multisite.

Other topics in this manual differentiate multisite and single-site clusters as needed.

| | About indexer clusters and index replication | | The basics of indexer cluster architecture | | | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------- | | ------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------- |

This documentation applies to the following versions of Splunk® Enterprise: 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.4.0, 9.4.1, 9.4.2