https://community.splunk.com/t5/Deployment-Architecture/Backup-of-indexed-data-in-cluster-with-two-nodes-and-replication/m-p/116029#M4382 <P>If there are only 2 nodes and RF = 2 and the cluster met all policies (the dashboard is green), then you can take back up from single node.</P> Fri, 30 Jan 2015 17:20:42 GMT mahamed_splunk 2015-01-30T17:20:42Z https://community.splunk.com/t5/Deployment-Architecture/Backup-of-indexed-data-in-cluster-with-two-nodes-and-replication/m-p/116028#M4381 <P>Hi,</P> <P>we have a multisite indexers cluster with two nodes and replication factor = 2. All instances are running Splunk 6.2. In the <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Backupindexeddata#Clustered_data_backups">official documentation</A> we read that it is not possible to <EM>back up just the data on a single node, since there's no certainty that a single node contains all the data in the cluster</EM>.</P> <P>I suspect that this is not true in our scenario, where all data are replicated to both nodes (replication factor = total number of peers). Am I right? Can we backup data from one node (snapshot backup) and be sure that all data has been saved?</P> Fri, 30 Jan 2015 12:57:15 GMT https://community.splunk.com/t5/Deployment-Architecture/Backup-of-indexed-data-in-cluster-with-two-nodes-and-replication/m-p/116028#M4381 mas 2015-01-30T12:57:15Z https://community.splunk.com/t5/Deployment-Architecture/Backup-of-indexed-data-in-cluster-with-two-nodes-and-replication/m-p/116029#M4382 <P>If there are only 2 nodes and RF = 2 and the cluster met all policies (the dashboard is green), then you can take back up from single node.</P> Fri, 30 Jan 2015 17:20:42 GMT https://community.splunk.com/t5/Deployment-Architecture/Backup-of-indexed-data-in-cluster-with-two-nodes-and-replication/m-p/116029#M4382 mahamed_splunk 2015-01-30T17:20:42Z https://community.splunk.com/t5/Deployment-Architecture/Backup-of-indexed-data-in-cluster-with-two-nodes-and-replication/m-p/116030#M4383 <P>Thank you.</P> <P>It would be nice to be able to check the cluster status before starting the backup job, raising a warning if it is not consistent. I think the only way to automate this check would be to run "bin/splunk show cluster-status --verbose" and check for "Replication factor met" and "Search factor met", but this command is available only on master node, while the check should be executed by the backup agent running on one of the peers. In addition, there would be an authentication request from Splunk daemon.</P> <P>As a result, I think it is not possible to automate this check in a simple way.</P> Mon, 02 Feb 2015 10:16:52 GMT https://community.splunk.com/t5/Deployment-Architecture/Backup-of-indexed-data-in-cluster-with-two-nodes-and-replication/m-p/116030#M4383 mas 2015-02-02T10:16:52Z