Deployment Architecture
Highlighted

How can I configure indexes to replicate data with each other in a Splunk deployment?

Communicator

Hi everyone
I am planning to create a Splunk lab.
I want
2 Forwarders- who will receive the logs from multiple sources(windows, UNIX, log files, etc)
2 indexers who are you replicating data with each other

One search head.

For forwards high availability I configure both indexers IP’s in output.conf file in both Forwarders.

Q-Now how can I configure indexes to replicate data with each other?

0 Karma
Highlighted

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

Champion

you can configure indexer clustering. Refer below docs:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Aboutclusters

0 Karma
Highlighted

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

Communicator

hi
thanks for your kind reply.
I believe that I need another server as index cluster.
I am limited with resources.

0 Karma
Highlighted

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

Champion

This is not best practice, but you can make your search head as cluster master and then configure indexer clustering, as you have limited resources.

0 Karma
Highlighted

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

Splunk Employee
Splunk Employee

More than "not best practice", using a search head as the cluster master is not supported. See http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Systemrequirements#Required_Splunk_Enterpr...

0 Karma
Highlighted

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

SplunkTrust
SplunkTrust

Don't cluster your indexers until you have 3 indexers and 1 cluster master available

0 Karma
Highlighted

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

Contributor

Hi,

You can configure your SH to search through both indexers .

That will be the best shot in this scenario

0 Karma
Highlighted

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

Contributor

Hi

Configure your SH to search thru both indexers.

Thats will be the best shot for dev . environment

Highlighted

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

Communicator

@ssadanala1
thanks.
it is helpful to understand basic concept.

0 Karma
Highlighted

Re: How can I configure indexes to replicate data with each other in a Splunk deployment?

Communicator

how can I accept your answer

0 Karma