All Apps and Add-ons

How to stop db connect after the server of the recipient of the forwarded events is unavailable?

chelnosl
New Member

We have a single server Splunk enterprise № 1, which receives data from the database using DB connect. We have another server Splunk enterprise № 2. Server Splunk № 1 sends events to Splunk № 2 using forwarding. When server № 2 becomes unavailable, events from DB connect cease to arrive at the server Splunk №1. After resuming the availability of the server number 2, everything is restored.
How to make independent server № 1 and server № 2?

0 Karma

ivanreis
Builder

Per my knowledge db connect is not built to work in high availability environment, this mean that if you deploy the db connect to different serves and keep the both of them enabled, the data will be indexed twice.
I did a solution to customer where the db connect was deployed in two separate heavy forwarder, but one of them remain disabled, so when the main heavy forwarder is down for any reason, the db connect on the stand by heavy forwarder have to be enabled manually and splunk service has to be restarted in order to continue indexing the data. The trick part here is you have to keep the both app update with the configuration. As the data is critical to the business I did not implement any automation to avoid the particular app to be enable by mistake and indexed the data twice. At the moment I don't have any other solution to share, I hope this helps you.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...