In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?
In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?
To store two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies in a four-site indexer cluster, the correct configuration involves the site search factor. The correct configuration is 'site_search_factor = origin:2, site2:1, total:4'. This ensures that each specified site has the required number of searchable copies, and the total number of searchable copies across all sites adds up to four.
B should be answer
B, as we are talking about searchable copies and not replication policy
The question is about searchable copies, not replication policy
B is correct: https://docs.splunk.com/Documentation/Splunk/8.2.4/Indexer/Sitesearchfactor
Answer B: For example, if you have a three-site cluster with "site_replication_factor = origin:2, site1:1, site2:2, total:5", then, in site_search_factor, the origin value cannot exceed 2, the site1 value cannot exceed 1, the site2 value cannot exceed 2, and the total value cannot exceed 5.
site_search_factor = origin:2, site2:1, total:4
B: site_search_factor = origin:2, site2:1, total:4
It's B. D is just raw copies of data among sites, B is raw copies including tsidx files = searchable copies.
Ref: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Sitesearchfactor#Syntax
It's B... This attribute specifies the per-site searchable copy policy. It is specified globally and applies to all buckets in all indexes. https://docs.splunk.com/Documentation/Splunk/9.0.5/Indexer/Sitesearchfactor
Search copy config, B is correct
N is correct