Deployment Architecture

Splunk Standalone Instance - Is clustering available for high availability>

smcdonald20
Path Finder

Hi,

We have a single standalone Splunk instance used for indexing, searching and alerts.
We want to have high availability in case one server goes down, but want to know if we can set up clustering so that Splunk manages the distribution of users/knowledge objects automatically.

I know that search head clustering and index clustering is possible, but not sure about a standalone instance as we can't see anything in the documentation...

Thanks,
Sophie

Tags (1)
0 Karma

woodcock
Esteemed Legend

What EXACTLY do you mean by Standalone Instance?

0 Karma

woodcock
Esteemed Legend

@gcusello is describing Index(er) Clustering which protects the data. There is also Search Head Clustering to provide access to searchability.
Copied from the Distributed Search Manual:
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements

Required number of instances
The cluster must contain at a minimum the number of members needed to fulfill both of these requirements:

  • Three members, so that the cluster can continue to function if one member goes down. See "Captain election process has deployment implications."
  • The replication factor number of instances. See "Choose the replication factor for the search head cluster."

For example, if your replication factor is either 2 or 3, you need at least three instances. If your replication factor is 5, you need at least five instances.

You can optionally add more members to boost search and user capacity (and complexity and fragility).

0 Karma

smcdonald20
Path Finder

Thanks @woodcock

Can you confirm if search head clustering will work with standalone instances?
So i assume the knowledge objects (searches, alerts, dashboards etc) will be clustered, but i'm wondering will the underlying data also be clustered with SH clustering?

OR are you saying that we'd move to distributed environment and do SH and IDX clustering for full HA?

0 Karma

woodcock
Esteemed Legend

Neither of these options work with All-in-one architecture. For Indexers, you need multiple indexers and a Cluster Master. For Search Heads, you need multiple Search Heads.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @smcdonald20,
until the version 6.x it was possible to have two standalone clustered Splunk servers, from the version 7.x it isn't possible to do this because searches on clustered Indexers don't run.
You need at least:

  • two Indexers;
  • one Master Node (it isn't possible to use an Indexer for this role);
  • at least one Search Head (it isn't possible to use the Master Node or one Indexer for this role).

In few words you need at least four servers.

In addition if you want HA also on Search Heads:

  • if you want a real HA, you need at least three Search Heads and a Deployer (that could be shared with the Master Node),
  • if you want a cold HA, you need at least two Searche Heads, and you have to manually manage the objects replication between Search Heads.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...