topic Re: High Availablity Implementation-Cluster in Deployment Architecture

High Availablity Implementation-Cluster

vijreddy30 — Mon, 25 Dec 2023 08:17:20 GMT

Hi Team,

In my project need to be implement High Availability servers in below Servers are using.

Z1-->L4 -->SearchHead+Indexer single instanceonly(Dev)

SearchHead+Indexer single instanceonly(QA)

DeploymentServer(QA)

HearvyForwarder(Prod)

DeploymentServe(Prod)

--------------------------------------------------

App related below server:

Z2 --> HearvyForwarder(Prod,Dev,QA) individual Servers

Z3--> HearvyForwarder(Prod,Dev,QA) individual Servers

The above App related servers are connected Deployment server and SearchHead+Indexer

Note : my project there is no Cluster master

Please help how do we implement the High Availability implementation, please help the guide the above servers.

Re: High Availablity Implementation-Cluster

gcusello — Mon, 25 Dec 2023 08:32:00 GMT

Hi @vijreddy30,

let me understand, quich kind of HA do you want to impement?

if HA on data, you need an Indexer Cluster: you need at least two Indexer and a Cluster master, you can find more information at https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Basicclusterarchitecture

If Ha in the presentation Layer, you neet a Search Head Cluster:, at least three Search Heads and a Deployer, as described at https://docs.splunk.com/Documentation/Splunk/9.1.2/DistSearch/SHCarchitecture

If at ingestion level, you need at least two Heavy Forwarders and a Load Balancer.

Ciao.

Giuseppe

Re: High Availablity Implementation-Cluster

isoutamo — Wed, 27 Dec 2023 09:11:23 GMT

it's just as @gcusello said. You cannot create HA environment without indexer cluster. That needs minimum three nodes: manager node and minimum two peer.

Here is https://www.splunk.com/en_us/pdfs/tech-brief/splunk-validated-architectures.pdf document which you should read and use as a base instructions how different splunk installations are working and for what purpose those are targeted.

r. Ismo

Re: High Availablity Implementation-Cluster

vijreddy30 — Tue, 02 Jan 2024 08:37:27 GMT

Thanks for your help.

In my project there is no Cluster master, Deployment Server have, can i user deployment server as Cluster master?

SearchHead and Indexer are single instance.

Regards,

Vij

Re: High Availablity Implementation-Cluster

isoutamo — Wed, 03 Jan 2024 08:21:26 GMT

based on this document https://docs.splunk.com/Documentation/Splunk/9.1.2/Deploy/Manageyourdeployment you cannot combine DS and CM on same server instance.

r. Ismo

Re: High Availablity Implementation-Cluster

gcusello — Wed, 03 Jan 2024 08:26:17 GMT

Hi @vijreddy30 ,

you need a Cluster Manager only if you have an Indexer Cluster, so at least two Indexers.

Anyway, you cannot use a Deployment Server as Cluster Manager and you cannot use the same server for these roles:

Cluster Manager must have a dedicated server,
Deployment Server can be in a shared server (not Search Head Or Indexer or Cluster Manager) only if it has to manage less than 50 clients, otherwise a dedicated server is required.

Ciao.

Giuseppe

Re: High Availablity Implementation-Cluster

vijreddy30 — Wed, 03 Jan 2024 14:08:07 GMT

Thanks for your guidelines.

Re: High Availablity Implementation-Cluster

gcusello — Wed, 03 Jan 2024 15:02:10 GMT

Hi @vijreddy30 ,

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉