https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188736#M37633 <P>My firewalls are sending their logs to Forwarders. Can I either redirect them to a NAS when the Forwarders are rebooting or have the Forwarder access them from the NAS and make the NAS the default?<BR /> Not certain I understand... <BR /> Thx</P> Fri, 14 Mar 2014 18:08:30 GMT garyewhite 2014-03-14T18:08:30Z https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188734#M37631 <P>Anyone have highly available forwarders deployed? Looking for the 'best' solution.<BR /> Hate to drop logs during maintenance cycles, even if it's only 3-5 minutes worth...<BR /> Any suggestions appreciated.</P> Fri, 14 Mar 2014 15:36:37 GMT https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188734#M37631 garyewhite 2014-03-14T15:36:37Z https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188735#M37632 <P>Why not saving the logs on a NAS and forwarding data from a dedicated silly VM? </P> Fri, 14 Mar 2014 16:51:08 GMT https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188735#M37632 rechteklebe 2014-03-14T16:51:08Z https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188736#M37633 <P>My firewalls are sending their logs to Forwarders. Can I either redirect them to a NAS when the Forwarders are rebooting or have the Forwarder access them from the NAS and make the NAS the default?<BR /> Not certain I understand... <BR /> Thx</P> Fri, 14 Mar 2014 18:08:30 GMT https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188736#M37633 garyewhite 2014-03-14T18:08:30Z https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188737#M37634 <P>I would imagine a load balancer would be your best bet. If you have to perform maintenance to your forwarders if you do them one at a time the load balancer would see the device as down and send the traffic to an available forwarder.</P> Fri, 14 Mar 2014 18:28:36 GMT https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188737#M37634 antlefebvre 2014-03-14T18:28:36Z https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188738#M37635 <P>I agree... but load balancing is easy when we're talking Indexers... I've done that. Load balancing the Forwarder(s) is uncharted territory, for me, though...<BR /> Anyone have a working, balanced, Forwarder config they can recommend?<BR /> Thanks!</P> Fri, 14 Mar 2014 18:52:17 GMT https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188738#M37635 garyewhite 2014-03-14T18:52:17Z https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188739#M37636 <P>Do you have a load balancer in your environment? If so, you just put the same forwarder config on 2 different machines. Point the firewalls at the balancer, balancer at the forwarders, and the forwarders will send the data to the indexers.</P> Fri, 14 Mar 2014 19:00:28 GMT https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188739#M37636 antlefebvre 2014-03-14T19:00:28Z https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188740#M37637 <P>No load balancer, at the moment. Looking for suggestions on type: Hardware/Software, and possibly examples of live configs that work well.</P> Mon, 17 Mar 2014 15:04:53 GMT https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188740#M37637 garyewhite 2014-03-17T15:04:53Z https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188741#M37638 <P>Going with a Baracuda 540. </P> Mon, 17 Mar 2014 20:20:42 GMT https://community.splunk.com/t5/Getting-Data-In/Highly-Available-Forwarder/m-p/188741#M37638 garyewhite 2014-03-17T20:20:42Z