diff --git a/ghetto/notes/SplunkClustering/AlwaysCluster.md b/ghetto/notes/SplunkClustering/AlwaysCluster.md
new file mode 100644
index 0000000..918d7ea
--- /dev/null
+++ b/ghetto/notes/SplunkClustering/AlwaysCluster.md
@@ -0,0 +1,12 @@
+[clustering]
+multisite = true
+available-sites = site1
+site_replication_factor = origin:1, total:1
+site_search_factor = origin:1, total:1
+pass4Symmkey = <something_here>
+cluster_label = <foo>
+replication_factor = 1
+search_factor = 1
+
+[general]
+site = site1