topic Forwarding data to dynamic IPs in Knowledge Management

Forwarding data to dynamic IPs

av_ — Wed, 08 May 2024 13:48:40 GMT

I am trying to forward data from UF to few indexers but the indexes have dynamic IPs which keep changing. Now, how does the UF know where to forward the data
How can I tackle this problem?

Also, can someone explain what is a smartstore & how does it work?

Re: Forwarding data to dynamic IPs

deepakc — Thu, 09 May 2024 08:35:11 GMT

I've never come across an Splunk environment that uses dynamic IP's for indexers (might be asking for trouble) , but there may be some use cases, I don't know, probably cloud environments. Normally one would use static IP's and DNS service and name's for UF to Indexers communications. You would then configure your outputs.conf with those DNS names. The UF's have inbuilt functionality to spray portions of the data across the Indexers. So DNS may be the way forward for you.

Example outputs.conf

[tcpout]
defaultGroup = my_indexers

[tcpout:my_indexers]
server = indexer1.example.com:9997, indexer2.example.com:9997

If using Indexer cluster, you can use the Cluster Master Discovery Option - Read all about it here.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/indexerdiscovery

Regarding Smart Store - Read all about it here.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/AboutSmartStore

Re: Forwarding data to dynamic IPs

hrawat — Thu, 09 May 2024 11:47:11 GMT

If there is a NLB in between UF/HF and indexing tier, you don't have to worry as DNS should return static IPs for NLB.
If there is no NLB in between UF/HF and indexing tier and you are banking on DNS to return dynamic IPs and your possible outputs.conf config is

server=<DNS alias for dynamic idx IPs>:<splunktcp port>

you must reduce dnsResolutionInterval in outputs.conf as low as possible. It will decide how fast new dynamic IPs picked by UF/HF.