Keep the following important points in mind when you deploy Ingest-Tier Scaling:

• For multisite indexer clusters, we recommend separate SQS queues and S3 buckets for smartbus blobs per site.
  • This ensures that the indexers from each site share the ingestion load with fellow indexers from the same site and do not compete with remote site indexers.
  • This may add ingestion latency for indexers from the far site.
  • This also means that the SQS and smartbus S3 bucket settings are asymmetric for different sites; therefore, you may need to push them through REST APIs to each indexer (instead of a cluster bundle push) as a one-time provisioning.
• For multisite indexer clusters, we recommend separate SQS queues and S3 buckets for smartbus blobs per site.
  • This ensures that the indexers from each site share the ingestion load with fellow indexers from the same site and do not compete with remote site indexers.
  • This may add ingestion latency for indexers from the far site.
  • This also means that the SQS and smartbus S3 bucket settings are asymmetric for different sites; therefore, you may need to push them through REST APIs to each indexer (instead of a cluster bundle push) as a one-time provisioning.
• We recommend using the S2S encoding format for blobs. Tests have shown S2S to be faster than Protobuf in the Splunk Cloud Platform service.
• We highly recommend using the SSE-C encryption scheme to implement better security measures and protect the ingest blobs.
• We highly recommend that forwarders and HEC inputs use useACK. The default send_interval is 4 seconds, and ingestors can crash during this interval, which can lead to data loss. With useACK, the system no longer creates back pressure, and the performance penalty is minimal because the system sends the ACK as soon as the message arrives on the smart bus.
• For single-site indexer clusters, you can push smartbus configuration through a cluster bundle push.