https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-fail-over-rather-than-load-balancing-on/m-p/114448#M23936 <P>Thanks MuS!! Appreciate your quick response.</P> Tue, 09 Sep 2014 01:21:38 GMT luhadia_aditya 2014-09-09T01:21:38Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-fail-over-rather-than-load-balancing-on/m-p/114446#M23934 <P>While architecting the splunk implementation we are caught up in to a scenario wherein we are trying to achieve fail-over, high availability configuration on to Heavy Forwarders. The requirement goes as -</P> <P>We have 2 heavy forwarders (currently only one in use) on which data is written in to the log files using syslog-ng, further those log files are being monitored by Heavy Forwarders, note here that syslog-ng and heavy forwarder reside on the same instance. This particular instance actually listens on to a network port and then syslog-ng filters and writes that data to specific log files.</P> <P>Now we would want to have the other heavy forwarder to act as a secondary instance, and if the primary (or first) heavy forwarder goes down then secondary heavy forwarder should start receiving data automatically. </P> <P>We are not looking forward to have auto load balancing in which data would be forwarded to both the heavy forwarders simultaneously and if one goes down, other is still on duty. No. As stated we want fail over rather than auto LB.</P> <P>Is this achievable ? <BR /> Any help, configurations, ideas, links, pointers are appreciable! <BR /> Thanks everyone.</P> Mon, 08 Sep 2014 04:47:47 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-fail-over-rather-than-load-balancing-on/m-p/114446#M23934 luhadia_aditya 2014-09-08T04:47:47Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-fail-over-rather-than-load-balancing-on/m-p/114447#M23935 <P>Hi luhadia_aditya,</P> <P>This is not related to Splunk. You need to setup this outside Splunk by using some other technique like F5 Network devices or DNS alias or Linux Heartbeat. Check <A href="http://www.google.com">Dr. Google</A> there are tons of article related to syslog and fail-over / load-balancing setups.</P> <P>cheers, MuS</P> Mon, 08 Sep 2014 05:58:01 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-fail-over-rather-than-load-balancing-on/m-p/114447#M23935 MuS 2014-09-08T05:58:01Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-fail-over-rather-than-load-balancing-on/m-p/114448#M23936 <P>Thanks MuS!! Appreciate your quick response.</P> Tue, 09 Sep 2014 01:21:38 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-fail-over-rather-than-load-balancing-on/m-p/114448#M23936 luhadia_aditya 2014-09-09T01:21:38Z