https://community.splunk.com/t5/Getting-Data-In/Splunk-Forwarder-HA-load-balancing/m-p/50520#M9652 <P>The forwarders behavior "out of the box" is to forward data to whatever indexers that are available.</P> <P>In you scenario your secondary indexer could be turned off by default (i.e. not running) - and with some script check if your primary indexer is not running. If the primary indexer is not running - then start the secondary indexer.</P> <P>Seen from the forwarder point of view - this is a "no-brainer" as it will buffer any inputs if your primary indexer dies until it can deliver to your secondary indexer (and vice versa).</P> <P>The problem with this approach might be if you need to search the data from your primary indexer if this becomes unavailable.</P> <P>I have not tried this my self - but this should work.</P> <P>Another approach is to deploy a network load-balancer in front of both indexers, and let this device send data to either your primary or your secondary indexer. </P> Fri, 13 Jan 2012 10:16:39 GMT RubenOlsen 2012-01-13T10:16:39Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Forwarder-HA-load-balancing/m-p/50519#M9651 <P>I know that we could configure Auto-load balancing on multiple indexer. <BR /> But I want to use an active standby approach to license count on duplicated data. </P> <P>In this case, could I configure the forwarder to route all the event an indexer primarily and route to another indexer when primarily indexer is not available. </P> Fri, 13 Jan 2012 07:19:58 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Forwarder-HA-load-balancing/m-p/50519#M9651 alexlee-mv 2012-01-13T07:19:58Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Forwarder-HA-load-balancing/m-p/50520#M9652 <P>The forwarders behavior "out of the box" is to forward data to whatever indexers that are available.</P> <P>In you scenario your secondary indexer could be turned off by default (i.e. not running) - and with some script check if your primary indexer is not running. If the primary indexer is not running - then start the secondary indexer.</P> <P>Seen from the forwarder point of view - this is a "no-brainer" as it will buffer any inputs if your primary indexer dies until it can deliver to your secondary indexer (and vice versa).</P> <P>The problem with this approach might be if you need to search the data from your primary indexer if this becomes unavailable.</P> <P>I have not tried this my self - but this should work.</P> <P>Another approach is to deploy a network load-balancer in front of both indexers, and let this device send data to either your primary or your secondary indexer. </P> Fri, 13 Jan 2012 10:16:39 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Forwarder-HA-load-balancing/m-p/50520#M9652 RubenOlsen 2012-01-13T10:16:39Z