How can I configure indexes to replicate data with each other in a Splunk deployment?

[rashid47010]

Hi everyone
I am planning to create a Splunk lab.
I want
2 Forwarders- who will receive the logs from multiple sources(windows, UNIX, log files, etc)
2 indexers who are you replicating data with each other

One search head.

For forwards high availability I configure both indexers IP’s in output.conf file in both Forwarders.

Q-Now how can I configure indexes to replicate data with each other?

[adonio · Accepted solution]

@rashid47010,
please refer to above comments by @SteveG and @skoelpin
for an indexer cluster to replicate data you will need at least 4 machines - 1 Cluster Master, 1 Search Head and 2 Indexers.

hope it helps

[ssadanala1]

Hi

Configure your SH to search thru both indexers.

Thats will be the best shot for dev . environment

[rashid47010]

how can I accept your answer

[rashid47010]

@ssadanala1
thanks.
it is helpful to understand basic concept.

[ssadanala1]

Hi,

You can configure your SH to search through both indexers .

That will be the best shot in this scenario

[p_gurav]

you can configure indexer clustering. Refer below docs:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Aboutclusters

[rashid47010]

hi
thanks for your kind reply.
I believe that I need another server as index cluster.
I am limited with resources.

[skoelpin]

Don't cluster your indexers until you have 3 indexers and 1 cluster master available

[p_gurav]

This is not best practice, but you can make your search head as cluster master and then configure indexer clustering, as you have limited resources.

[Steve_G_]

More than "not best practice", using a search head as the cluster master is not supported. See http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Systemrequirements#Required_Splunk_Enterpr...