Managing Indexers and Clusters of Indexers

 


Troubleshoot indexers and clusters of indexers

Multisite indexer cluster deployment overview

Multisite indexer cluster deployment overview

Read this first

Before reading this topic, see:

Migrating from a single-site cluster?

To migrate from a single-site to a multisite indexer cluster, read "Migrate an indexer cluster from single-site to multisite".

Deploy a multisite indexer cluster

To deploy a multisite cluster, you configure the set of nodes for each site:

  • A single master resides on one of the sites and controls the entire multisite cluster.
  • A set of peer nodes resides on each site.
  • A search head resides on each site that searches cluster data. If you want all searches to be local,¬†you must install a search head on each site. This is known as search affinity.

For example, to set up a two-site cluster with three peers and one search head on each site, you install and configure these instances:

  • One master node on one of the sites, either site 1 or site 2
  • Three peer nodes on site 1
  • Three peer nodes on site 2
  • One search head on site 1
  • One search head on site 2

Note: The master itself is not actually a member of any site, aside from its physical location. However, each master has a built-in search head, and that search head requires that you set a site attribute in the master's configuration. You must specify a site for the master, even if you never use its built-in search head. Note that the search head is for testing only. Do not use it for production purposes.

Configure multisite nodes

To deploy and configure multisite cluster nodes, you must directly edit server.conf or use the CLI. You cannot use Splunk Web.

Multisite-specific configuration settings

When you deploy a multisite cluster, you configure the same settings as for single-site, along with some additional settings to specify the set of sites and the location of replicated and searchable copies across the sites.

On the master, you:

  • Enable the cluster for multisite.
  • Enumerate the set of sites for the cluster.
  • Set a multisite replication factor.
  • Set a multisite search factor.

On each cluster node, you:

  • Identify the site that the node resides on.

Configure with server.conf

For information on configuring a multisite master node with server.conf, see "Configure multisite indexer clusters with server.conf".

Configure with the CLI

For information on configuring a multisite master node with the CLI, see "Configure multisite indexer clusters with the CLI"

This documentation applies to the following versions of Splunk: 6.1 , 6.1.1 , 6.1.2 , 6.1.3 , 6.1.4 , 6.2.0 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!