Sentinel One with Indexer Cluster

[dpct]

Hi all,

I have set up an indexer cluster to achieve High Availability at ingestion phase.

i'm aware about Update peer configuration  and i have reviewed intrusction under details tab from SentinelOne App .  

I can not see an explict mention to a indexer-cluster setup.

What are the steps to setup input configuration for a indexer cluster avoiding data duplication?

Thanks for your help

[richgalloway]

The only inputs that should be enabled on an indexer are those that query the local server.  Otherwise, data duplication may results.

Per the SentinelOne installation instructions, the inputs app should be installed on a heavy forwarder.  No matter what the indexer configuration is, the IA goes on a HF.  Only the TA should be installed on the indexers.

FTR, it is not necessary to use an index cluster to have high availability on ingest.  HA on ingest is provided by having forwarders distribute data across more than one indexer.  Indexer clusters protect the data by having multiple copies of it.  The extra copies offer HA at search time.

[dpct]

Hi richgallowy,

thanks for your answer and clarifications.

In case i install IA on one HF and that HF goes down i'm not collecting anymore SentinalOne logs. am i right? 

[richgalloway]

That is correct, but an indexer cluster would not solve that problem.

I suggest having two HFs in an active/warm standby configuration.  There would need to be some means to copy state information from the active HF to the standby.  That would be a non-Splunk solution.