topic Re: Move Index Files from one system to another in Splunk Dev

Move Index Files from one system to another

brianokelly — Mon, 28 Sep 2020 09:55:21 GMT

We are planning to roll out an active/active solution in two data centers. Each DC splunk instance will only handle local logs. We are looking to put a plan in place should a failure of one site occur.

What is the best mechanism/tools to handle this situation.
What should be planned for e.g. use different index names in each site e.g. main_site1 and main_site2? Both sites will handle similar logs and peer to each other for searches.

Re: Move Index Files from one system to another

MuS — Wed, 28 Sep 2011 11:37:52 GMT

Hi brainokelly

about moving an index find the docs here.

If you plan to move one site to another in case of a failure, then I would do as you wrote in question 2. Call them main_site1 and main_site2. This way you are able to move the index back to its original site and even keep the data collected while it was on the failure site.

hope you can follow me 🙂

Re: Move Index Files from one system to another

Lowell — Wed, 28 Sep 2011 14:07:38 GMT

I'd suggest that you also checkout this question and answer:

http://splunk-base.splunk.com/answers/7479/what-is-the-best-way-to-retrieve-data-from-a-remote-site-splunk-index

There's a comment about the isReadOnly setting in indexes.conf which you may want to look into as well. The idea is to prevent accidental writing to a replicated index. It's possible that read-only file permissions may also be a good idea in this case. (BTW, I assuming that you aren't going to try to let both sites index data into both each others directories, because that will not work.)

It may be a good idea to work though a plan with splunk support for your specific setup.