Deployment Architecture

Can you answer a question regarding backing up an indexer cluster?

christay
New Member

Hi,

I am quite new to the Splunk setup, so as such, pardon my question here.

Given that, if i have a 2 x indexer setup in a Cluster, is it possible for me to shutdown 1 of the indexers ( Save cost as it's running on AWS) and still get the latest data replicated into the shutdown indexer from the active indexer ?

So, in the event that the primary active indexer is down, I can bring up the shutdown indexer to take over the role?

Is the above scenario possible ?

Or do I definitely have to have both the indexer instance online to get the latest data ingested ?

Thanks

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

An indexer must be running to receive replicated buckets. While an indexer is down, the cluster master (CM) will keep track of the buckets that need to be replicated to that indexer. Once the indexer comes back up, it will receive replicated buckets in the background while processing new events and search requests.

Indexer clustering is not a cold-backup solution.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Yes indexer clustering requires all indexers only.

If you are on AWS and looking to save money, consider using smart store: https://www.splunk.com/blog/2018/10/11/splunk-smartstore-cut-the-cord-by-decoupling-compute-and-stor... . This will store the data in S3 buckets which different indexers can basically share.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

An indexer must be running to receive replicated buckets. While an indexer is down, the cluster master (CM) will keep track of the buckets that need to be replicated to that indexer. Once the indexer comes back up, it will receive replicated buckets in the background while processing new events and search requests.

Indexer clustering is not a cold-backup solution.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...