Implement search affinity in a multisite indexer cluster
One of the key benefits of multisite indexer clustering is that it allows you to configure a cluster so that search heads get search results only from data stored on their local sites. This reduces network traffic while still providing access to the entire set of data, because each site contains a full copy of the data. This benefit is known as search affinity.
For example, say you have two data centers in California, one in San Francisco and the other in Los Angeles. You set up a two-site cluster, with each site corresponding to a data center. Search affinity allows you to reduce long-distance network traffic. Search heads at the San Francisco data center get results only from the peers in San Francisco, while search heads in Los Angeles get results only from their local peers.
How search affinity works
For those sites that you want to support search affinity, you must configure multisite clustering so that the site has a full set of searchable data and a local search head. The search head on any particular site then gets data only from its local site, as long as that site is valid.
If a local peer holding some of the searchable data goes down and the site temporarily loses its valid state, the search head will, if necessary, access data from peers on remote sites while the local site is undergoing bucket fixing. During this time, the search head will still get as much of the data as possible from the local site.
Once the site regains its valid state, new searches again occur across only the local site.
For more details on how the cluster handles search affinity, see "Multisite indexer cluster architecture".
Implement search affinity
Search affinity is always enabled with multisite clusters. However, you must perform a few steps to take advantage of it. Specifically, you must ensure that both the searchable data and the search heads are available locally.
To implement search affinity:
1. Configure the site search factor so that you have at least one searchable copy on each site where you require search affinity.
One way to do this is to explicitly specify a search factor for each site that requires search affinity. For example, a four-site cluster with
site_search_factor = origin:1, site1:1, site2:1, total:3 ensures that both site1 and site2 have searchable copies of every bucket. The third set of searchable copies will be spread across the two non-explicit sites, with no guarantee that either site will have a full set of searchable copies. Thus, search affinity is enabled for only site1 and site2.
There are also ways to configure the site search factor to ensure that all sites have searchable copies, even without explicitly specifying some or all of them. For example, a three-site cluster with
site_search_factor = origin:1, total:3 guarantees one searchable copy per site, and thus enables search affinity for each site.
2. Deploy a search head on each site where you require search affinity.
Multisite indexer cluster deployment overview
Configure multisite indexer clusters with server.conf
This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10