...
Figure 40.5 Port Requirement for IPv4 and IPv6 Single-site Clustering Place for Fig. | Drawio |
|---|
| border | true |
|---|
| viewerToolbar | true |
|---|
| |
|---|
| fitWindow | false |
|---|
| diagramName | 40.5 |
|---|
| simpleViewer | false |
|---|
| width | |
|---|
| revision | 2 |
|---|
|
- Multi-Site Cluster - A multi-site clustering configuration is useful when you want to manage multiple reporting sites at different locations, with each site having its own set of indexers. The multi-site clustering configuration is valid only when you associate all the reporting members in the cluster with the predefined ReportingSite extensible attribute. For information about the ReportingSite extensible attribute, see ReportingSite Extensible Attribute. In a multi-site cluster, you configure one of the sites as the primary site, and then plan other sites in a specific order. This order defines the next site of indexers to which the forwarders send data when the primary site is out of service. Note that all Grid members send data only to indexers in the primary site. You can designate a new primary site either by using the Grid Reporting Properties editor, or using the set promote_master CLI command. For more information about the CLI command, refer to the Infoblox CLI Guide. A multi-site cluster must have at least two sites with two reporting members in each site, as illustrated in Figure 40.6 . The first reporting site that you configure is the primary site, which also hosts the search head for the cluster. If the search head goes down, the Grid Master automatically chooses an available reporting member in the same site as the search head. If all the indexers in a site go down, or if you want to change the search head to another site, then you must manually redefine the primary site. Note that you must make one of the active sites as the primary site. In a multi-site cluster, the search factor (also known as the site search factor) determines both the number of searchable copies that the entire cluster maintains and the number of copies that each site maintains. By default, the search factor is set to 1 and the replication factor is 2 in a multi-site cluster.
...
When you change the configuration from a single indexer to a single-site cluster or multi-site cluster and from a single-site cluster to a multi-site cluster, the replication of data will start only for the new data that are created after you have completed the cluster mode configuration. When you change the configuration, the replication of new data starts only after you have completed the clustering configuration. Any data created prior to switching are restored on the primary site and are not replicated on the secondary site. To manage your reporting clustering data efficiently, see Guidelines for Deploying Reporting Clusters.
Figure 40.6 Sample Multi-Site Reporting ClusterPlace for Fig. | Drawio |
|---|
| border | true |
|---|
| viewerToolbar | true |
|---|
| |
|---|
| fitWindow | false |
|---|
| diagramName | 40.6 |
|---|
| simpleViewer | false |
|---|
| width | |
|---|
| revision | 1 |
|---|
|
For more information about how reporting cluster works, refer to the Splunk documentation at
http://docs.splunk.com/Documentation/Splunk/6.2.5/Indexer/Basicclusterarchitecture. Figure 40.7 Port Requirement for IPv4 and IPv6 Multi-site Clustering Place for Fig. 40.7 draw| Anchor |
|---|
| ReportingSite Extensible Attribute |
|---|
| ReportingSite Extensible Attribute |
|---|
|
ReportingSite Extensible Attribute
...
