Multisite indexer clusters in Kubernetes

Deploy multisite indexer clusters for high availability across Kubernetes zones.

Multisite indexer cluster architecture controls bucket replica placement across multiple availability zones, preventing data loss or search unavailability when a single zone fails.

You can use multisite indexer cluster architecture for various purposes. However, Kubernetes clusters are generally deployed at the scale of a region, and the main purpose of multisite configuration is to build high-availability indexer clusters that allow you to control the placement of bucket replicas across multiple availability zones. This prevents the failure of a single zone from causing events to become unavailable for search or permanently lost.

All cloud providers recommend designing applications that require high availability to support the loss of a zone (for example, GCP, AWS, Azure). In a private datacenter, multisite indexer clusters can support the loss of a room or rack. In the case of dedicated hardware with local storage used for Splunk (or various datastores), a multisite indexer cluster allows you to support regular maintenance (for example, OS upgrades) when multiple indexer pods are scheduled on the same host.

Refer to the Splunk Enterprise deployment examples for more information about deploying Splunk resources in single-site mode.