topic Re: Multi site Data center forwarding data to indexer? in Getting Data In

Multi site Data center forwarding data to indexer?

aab5272 — Fri, 23 Jun 2017 19:30:23 GMT

Considering multi site data center for log forwarding having same logs , lets say site 1 and site 2 logs are being forwarded to indexer ,will this two copy will counted twice while indexing license if yes then what should be the approach to filter one copy of data before forwarding ?

Re: Multi site Data center forwarding data to indexer?

koshyk — Sat, 24 Jun 2017 09:38:47 GMT

are you using Universal Forwarder to send these logs to Indexers? if yes, use autoLB and put names of all Indexers in the list to load balance, and the UF will work out where to send and it will send only one copy.

if you let me know which mechanism is used to send the data, we can answer. cheers

Re: Multi site Data center forwarding data to indexer?

woodcock — Sun, 25 Jun 2017 23:31:01 GMT

Any forwarder sending data into any Indexer will only be counted once. If 2 servers are sending the same data (perhaps through an NFS cross mount), then you will get 2 copies of the data in splunk and each will count against the license. If you have a multi-site cluster where splunk deliberately makes multiple copies internally (1 forwarder sends 1 copy to 1 Indexer, then SPLUNK makes copies all around), then you will only ever see/search 1 copy and it will only count against the license once.

Re: Multi site Data center forwarding data to indexer?

aab5272 — Mon, 26 Jun 2017 00:04:20 GMT

Thanks for the response .
we are going to collect all the logs with syslog-ng and UF and sending it to intermediate forwarder which in turn would send data to indexer .