Deployment Architecture

Deployment Client Sending Logs to Backup Log Collector

daniaabujuma
Explorer

Hello,

I have a question regarding forwarding and receiving in Splunk. Can I configure the deployment client to send logs to another log collector in case the first one is not responding or receiving logs? To be more specific, is there any kind of configuration that can be done so the deployment client will automatically switch to another log collector if the first one isn't available?

Thank you.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You are using "weird" terminology for Splunk. So I made some assumptions for those 😉

  • Deployment Client is usually called UF / forwarder.
  • Log Collector is indexer / search peer

You could add several indexer on outputs.conf and then UF can use all of those. But there is no automatic process how it can normally send to one indexer and if it's down then switch to another and go back when 1st will be back in the business.

When you have configured only one indexer in outputs.conf then if it's down then UF just stop sending data to it and wait until it will be back.

If/when you want to HA solution for receiving logs you should setup multiple individual indexers or even better to set up indexer cluster. See more about https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters

My personal opinion is that when you are setting up distributed environment, you should always set up also indexer cluster. If you have only few GBs per day ingested events, you could set up "single node cluster" and when your indexing amount will increase then it's really easy just to add additional nodes to that cluster.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...