We have a single standalone Splunk instance used for indexing, searching and alerts.
We want to have high availability in case one server goes down, but want to know if we can set up clustering so that Splunk manages the distribution of users/knowledge objects automatically.
I know that search head clustering and index clustering is possible, but not sure about a standalone instance as we can't see anything in the documentation...
@gcusello is describing
Index(er) Clustering which protects the data. There is also
Search Head Clustering to provide access to searchability.
Copied from the Distributed Search Manual:
Required number of instances
The cluster must contain at a minimum the number of members needed to fulfill both of these requirements:
For example, if your replication factor is either 2 or 3, you need at least three instances. If your replication factor is 5, you need at least five instances.
You can optionally add more members to boost search and user capacity (and complexity and fragility).
Can you confirm if search head clustering will work with standalone instances?
So i assume the knowledge objects (searches, alerts, dashboards etc) will be clustered, but i'm wondering will the underlying data also be clustered with SH clustering?
OR are you saying that we'd move to distributed environment and do SH and IDX clustering for full HA?
until the version 6.x it was possible to have two standalone clustered Splunk servers, from the version 7.x it isn't possible to do this because searches on clustered Indexers don't run.
You need at least:
In few words you need at least four servers.
In addition if you want HA also on Search Heads: