Multisite indexer cluster deployment overview
Before reading this topic, see:
- "Indexer cluster deployment overview". That topic provides a general overview of deployment for both single-site and multisite indexer clusters. The topic you are reading now describes only the multisite differences.
Migrating from a single-site cluster?
To migrate from a single-site to a multisite indexer cluster, read "Migrate an indexer cluster from single-site to multisite".
Deploy a multisite indexer cluster
To deploy a multisite cluster, you configure the set of nodes for each site:
- A single master resides on one of the sites and controls the entire multisite cluster.
- A set of peer nodes resides on each site.
- A search head resides on each site that searches cluster data. If you want all searches to be local, you must install a search head on each site. This is known as search affinity.
For example, to set up a two-site cluster with three peers and one search head on each site, you install and configure these instances:
- One master node on one of the sites, either site 1 or site 2
- Three peer nodes on site 1
- Three peer nodes on site 2
- One search head on site 1
- One search head on site 2
Note: The master itself is not actually a member of any site, aside from its physical location. However, each master has a built-in search head, and that search head requires that you set a site attribute in the master's configuration. You must specify a site for the master, even if you never use its built-in search head. Note that the search head is for testing only. Do not use it for production purposes.
Configure multisite nodes
To deploy and configure multisite cluster nodes, you must directly edit
server.conf or use the CLI. You cannot use Splunk Web.
Multisite-specific configuration settings
When you deploy a multisite cluster, you configure the same settings as for single-site, along with some additional settings to specify the set of sites and the location of replicated and searchable copies across the sites.
On the master, you:
- Enable the cluster for multisite.
- Enumerate the set of sites for the cluster.
- Set a multisite replication factor.
- Set a multisite search factor.
On each cluster node, you:
- Identify the site that the node resides on.
Configure with server.conf
To configure a multisite master node with
server.conf, see "Configure multisite indexer clusters with server.conf".
Configure with the CLI
To configure a multisite master node with the CLI, see "Configure multisite indexer clusters with the CLI"
Configure hybrid search
Implement search affinity in a multisite indexer cluster
This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11