A customer has a multisite cluster with site1 and site2 configured. They want to configure search heads in these sites to get search results only from data stored on their local sites. Which step…

Question

Options

• ASet site=site0 in the [general] stanza of server.conf on the search head.
• BConfigure site_search_factor = site1:1, total:2.
• CImplement only two indexers per site.
• DConfigure site_search_factor = site1:2, total:3.

• A
  58% (15)
• B
  12% (3)
• C
  23% (6)
• D
  8% (2)

Explanation

Splunk's multisite clustering documentation describes that search affinity is controlled by the site attribute in server.conf on the search head. Splunk explicitly states that assigning site=site0 on a search head removes site affinity, causing the search head to treat all sites as equal and search remotely as needed. The documentation describes site0 as the special value that disables local-site preference and forces the system to behave like a single-site cluster. The customer wants each site's search head to pull results only from its local site. This behavior works only if the search head's site value matches the local site name (e.g., site1 or site2). By setting it to site0, all locality restrictions are removed, which prevents the desired reduction of network The site search factor options (B and D) affect replication and searchable copy placement on indexers, not search head behavior. The number of indexers per site (C) also does not disable search affinity. Therefore only option A disables local-only searching. Splunk Indexer Clustering Manual (Multisite Search Affinity; server.conf site parameter).

No community discussion yet for this question.