topic Re: How can I configure indexes to replicate data with each other in a Splunk deployment? in Deployment Architecture

How can I configure indexes to replicate data with each other in a Splunk deployment?

rashid47010 — Sat, 14 Apr 2018 17:46:24 GMT

Hi everyone
I am planning to create a Splunk lab.
I want
2 Forwarders- who will receive the logs from multiple sources(windows, UNIX, log files, etc)
2 indexers who are you replicating data with each other

One search head.

For forwards high availability I configure both indexers IP’s in output.conf file in both Forwarders.

Q-Now how can I configure indexes to replicate data with each other?

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

p_gurav — Sun, 15 Apr 2018 06:16:06 GMT

you can configure indexer clustering. Refer below docs:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Aboutclusters

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

rashid47010 — Sun, 15 Apr 2018 10:06:56 GMT

hi
thanks for your kind reply.
I believe that I need another server as index cluster.
I am limited with resources.

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

p_gurav — Mon, 16 Apr 2018 04:30:31 GMT

This is not best practice, but you can make your search head as cluster master and then configure indexer clustering, as you have limited resources.

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

Steve_G_ — Mon, 16 Apr 2018 16:19:05 GMT

More than "not best practice", using a search head as the cluster master is not supported. See http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Systemrequirements#Required_Splunk_Enterprise_instances

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

skoelpin — Mon, 16 Apr 2018 21:00:04 GMT

Don't cluster your indexers until you have 3 indexers and 1 cluster master available

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

ssadanala1 — Tue, 17 Apr 2018 11:40:44 GMT

Hi,

You can configure your SH to search through both indexers .

That will be the best shot in this scenario

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

ssadanala1 — Tue, 17 Apr 2018 11:41:38 GMT

Configure your SH to search thru both indexers.

Thats will be the best shot for dev . environment

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

adonio — Tue, 17 Apr 2018 15:43:47 GMT

@rashid47010,
please refer to above comments by @SteveG and @skoelpin
for an indexer cluster to replicate data you will need at least 4 machines - 1 Cluster Master, 1 Search Head and 2 Indexers.

hope it helps

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

rashid47010 — Wed, 02 May 2018 08:37:06 GMT

@ssadanala1
thanks.
it is helpful to understand basic concept.

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

rashid47010 — Wed, 02 May 2018 08:40:24 GMT

how can I accept your answer