- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Distributed KV store with 2 search head?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello.
I'm running on RHEL 7 with 6.6.3 and an Indexer cluster (3 peers), and have 2 Search Heads not in a SHC but connected induvidually to the index cluster.
I try to use KV store with a custom built app where I store data in a Collection (Collections.conf and transforms.conf) that I wish to share with my other search head, but I'm failing and don't know how to proceed. My app is installed on both SH, it works locally on both, but my KV store instance seems locally even though I have set 'replicate = true' in my Collection stanza and 'replication_host = FQDN' in server.conf.
Reading about KV store I can't really find out if it should work unless you have a SHC, but on the other hand I can't find information it wouldn't.
is it possible to share a KV store whitout a SHC?
How do I configure the KV store to be stored at the index cluster and not locally?
The part of the 'replication_host' is a bit un clear what to type there on each host, but the description in server.conf lets me Believe it should be the local hosts FQDN?
Regards,
Jan
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Jan,
As far as I know, It is not possible (or better to say is not supported) what you want to implement.
replicate = true in collections.conf actually only makes this collections to be available directly on indexers, when you perform search from this search head, it does not affect KVStore replication between Search Heads.
Any reasons why you don't want to enable Search Head Cluster? Seems like you are looking on the replication between Search Heads, and SHC can provide you that.
Also one note, if you will decide to go with SHC - you want to setup minimum 3 nodes for reliability and consistency.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanx.
I guess i'll have to surrender to the SHC anyway. The reason for not going that path straight away is internal politics based on security and delegation by duty. Simply I wanted to have separate instances for some functions. No big deal but good you confirmed what I believed that it' not possible.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Jan,
As far as I know, It is not possible (or better to say is not supported) what you want to implement.
replicate = true in collections.conf actually only makes this collections to be available directly on indexers, when you perform search from this search head, it does not affect KVStore replication between Search Heads.
Any reasons why you don't want to enable Search Head Cluster? Seems like you are looking on the replication between Search Heads, and SHC can provide you that.
Also one note, if you will decide to go with SHC - you want to setup minimum 3 nodes for reliability and consistency.
Splunk Admins and App Developers | Earn a $35 gift card!
Enterprise Security Content Update (ESCU) | New Releases
Monitoring MariaDB and MySQL
