topic Can the Universal Forwarder send data to a second indexer as a failover after a first indexer went down? in Getting Data In

Can the Universal Forwarder send data to a second indexer as a failover after a first indexer went down?

cmonig — Tue, 21 Aug 2012 16:43:21 GMT

Hello,

is it possible to set up a Universal Forwarder in such a way that it uses one indexer, and will try to send it's data to a second configured indexer only when the first one is no longer available?

I generally need to only use one indexer. I do not want load balancing for now.
And I do not need/want to clone my data, for license reasons.

Thanks,

Christoph

Re: Can the Universal Forwarder send data to a second indexer as a failover after a first indexer went down?

kristian_kolb — Tue, 21 Aug 2012 16:53:20 GMT

To the best of my knowledge there is no out-of-the-box solution for this.

Perhaps you can make it work through some DNS trickery or have local script modifying the hosts file of the operating system. Maybe.

If you have the extra hardware standing by, why not use both?

UPDATE:

Well, I actually realized that it might be as simple as setting the AutoLBFrequency in outputs.conf on the forwarder to a VERY high value (billions). Then the forwarder should not switch to the alternate indexer unless the primary goes down.

Unfortunately, the forwarder would not switch back automatically when the primary is available again. You'd have to manually restart the alternate indexer, thereby terminating the sessions, which would cause the forwarders to return to the primary indexer.

This is a pretty weird approach, since you still need to have the alternate indexer up-and-running (or at least in hot standby) at all times.

Re: Can the Universal Forwarder send data to a second indexer as a failover after a first indexer went down?

kristian_kolb — Wed, 22 Aug 2012 14:54:15 GMT

see update above

Re: Can the Universal Forwarder send data to a second indexer as a failover after a first indexer went down?

cmonig — Wed, 12 Sep 2012 10:35:35 GMT

Thank you! This is indeed weird but interesting, and might actually work for me. Thank you for sharing your insight!
:-)

Re: Can the Universal Forwarder send data to a second indexer as a failover after a first indexer went down?

kristian_kolb — Wed, 12 Sep 2012 10:47:30 GMT

Glad it helped, even though I'm a bit curious to the reasons for the requirement.

Re: Can the Universal Forwarder send data to a second indexer as a failover after a first indexer went down?

hliu_splunk — Fri, 07 Apr 2017 23:42:02 GMT

this is officially supported in splunk 6.6.0.