Deployment Architecture

Data Archival-Clustered environment

garima_chauhan
Path Finder

Hi,
I have set up a clustered environment for testing purpose. The cluster comprises of 2 peers, a search head, a master node and a universal forwarder. All components are Splunk v5.0.5. I have set both the search factor and replication factor 2. I want to archive the data on each of the peers. When I push the common indexes.conf from the master node, I get indexing errors and the configuration does not work. If, I need to archive the data from both the peers, do I need to have a separate indexes.conf for each peer?

Thanks in anticipation.
Please respond.

Tags (2)
0 Karma

Steve_G_
Splunk Employee
Splunk Employee

All indexes need to be identical across all peers, if you want the data in the indexes to be replicated. See: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurethepeerindexes

Did you set repFactor=auto for any new indexes? If not, that might be the source of your configuration problems. This is explained in the topic referenced above.

0 Karma

garima_chauhan
Path Finder

Thanks Steve G. It turns out that the indexing errors that I was recieving were due to wrong configuration of archival policy.

0 Karma

austincisneros
New Member
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>