https://community.splunk.com/t5/Deployment-Architecture/Distributed-Deployment-Splunk-data-replication/m-p/56084#M1859 <P>You are correct that if one indexer is out, only half the data will be visible, though the search head will report that it is unable to reach all indexers.</P> <P>In the current version, there is no native replication of data. You will have to do this either using the underlying storage to replicate, or by forwarding from indexer to a replica instance. Both have disadvantages relative to the other. In addition, there is no built-in mechanism for failover, so you would have to implement this yourself. These solutions are not entirely simple to implement correctly and robustly. An overview of this is here: <A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/Installation/Highavailabilityreferencearchitecture">http://docs.splunk.com/Documentation/Splunk/4.3.2/Installation/Highavailabilityreferencearchitecture</A></P> <P>In future versions, you may expect some form of built-in replication, as well as a more automated built-in failover, that should be preferable to these other methods.</P> Sat, 19 May 2012 17:13:46 GMT gkanapathy 2012-05-19T17:13:46Z https://community.splunk.com/t5/Deployment-Architecture/Distributed-Deployment-Splunk-data-replication/m-p/56083#M1858 <P>Hi, </P> <P>I have a question with a distributed deployment...</P> <P>If a deployment was set-up to have for example:</P> <UL> <LI>2 x Indexers</LI> <LI>n x Forwarders (set-up to autoLb between the indexers)</LI> <LI>1 x Search Head</LI> </UL> <P>The autoLB will forward data to the Splunk indexers in a cycle based on time.What happens to the visibility of data if one of the Indexers was to become inactive (e.g. a system failure, etc). I would imagine that Splunk would be able to view ~half of the data, is this assumption correct?</P> <P>How would data replication between the Indexers take place? - If the there is a requirement for the data to remain 100% visible, what would be best to achieve this? </P> <P>I'm sure I have come across guidelines on data replication between two indexers in past notes/discussions/Splunk documentation. But I am not able to find the justification I require.</P> <P>Are there any thoughts on documentation or sources of information that would be useful?</P> <P>Any thoughts welcome, thanks in advance.</P> <P>Regards,</P> <P>MHibbin</P> Sat, 19 May 2012 16:37:40 GMT https://community.splunk.com/t5/Deployment-Architecture/Distributed-Deployment-Splunk-data-replication/m-p/56083#M1858 MHibbin 2012-05-19T16:37:40Z https://community.splunk.com/t5/Deployment-Architecture/Distributed-Deployment-Splunk-data-replication/m-p/56084#M1859 <P>You are correct that if one indexer is out, only half the data will be visible, though the search head will report that it is unable to reach all indexers.</P> <P>In the current version, there is no native replication of data. You will have to do this either using the underlying storage to replicate, or by forwarding from indexer to a replica instance. Both have disadvantages relative to the other. In addition, there is no built-in mechanism for failover, so you would have to implement this yourself. These solutions are not entirely simple to implement correctly and robustly. An overview of this is here: <A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/Installation/Highavailabilityreferencearchitecture">http://docs.splunk.com/Documentation/Splunk/4.3.2/Installation/Highavailabilityreferencearchitecture</A></P> <P>In future versions, you may expect some form of built-in replication, as well as a more automated built-in failover, that should be preferable to these other methods.</P> Sat, 19 May 2012 17:13:46 GMT https://community.splunk.com/t5/Deployment-Architecture/Distributed-Deployment-Splunk-data-replication/m-p/56084#M1859 gkanapathy 2012-05-19T17:13:46Z