topic Re: Data Archival-Clustered environment in Deployment Architecture

Data Archival-Clustered environment

garima_chauhan — Mon, 27 Jan 2014 11:21:22 GMT

Hi,
I have set up a clustered environment for testing purpose. The cluster comprises of 2 peers, a search head, a master node and a universal forwarder. All components are Splunk v5.0.5. I have set both the search factor and replication factor 2. I want to archive the data on each of the peers. When I push the common indexes.conf from the master node, I get indexing errors and the configuration does not work. If, I need to archive the data from both the peers, do I need to have a separate indexes.conf for each peer?

Thanks in anticipation.
Please respond.

Re: Data Archival-Clustered environment

Steve_G_ — Wed, 29 Jan 2014 00:32:19 GMT

All indexes need to be identical across all peers, if you want the data in the indexes to be replicated. See: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurethepeerindexes

Did you set repFactor=auto for any new indexes? If not, that might be the source of your configuration problems. This is explained in the topic referenced above.

Re: Data Archival-Clustered environment

garima_chauhan — Fri, 31 Jan 2014 08:17:42 GMT

Thanks Steve G. It turns out that the indexing errors that I was recieving were due to wrong configuration of archival policy.

Re: Data Archival-Clustered environment

austincisneros — Mon, 04 Feb 2019 18:50:13 GMT

https://www.conducivesi.com/splunk-archiver-video/