Deployment Architecture

How can Splunk be deployed to support DR and not HA functionality ?

damode
Motivator

As the title suggests, I would like to seek help in understanding how Splunk can be deployed to support DR and not HA functionality.

0 Karma

adonio
Ultra Champion

hello there,

i think there is not enough space here to dive into the details but in a really high overview, lets start with DR.
when talking DR, you are mainly talking about RTO and RPO, more info here: https://en.wikipedia.org/wiki/Recovery_point_objective
depending on your RPO and RTO, you can go anywhere from a hot standby machine to regular recovery from backup.
as for HA, explained here: https://www.techopedia.com/definition/1021/high-availability-ha
consider 4 main layers / tiers in splunk: (1) Indexer layer, where data sits (2) search layer, where your knowledge objects and defined actions on the data exists. (3) forwarding layer, all forwarder and heavy forwarders. (4) management layer - all other splunk server roles
i will cover (1) and (2) here:
you can achieve HA on Indexer layer leveraging Indexer Cluster and Multi-site Indexer Cluster, read here all the way through: http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Aboutclusters
you can also achieve HA to your search tier leveraging Search Head Clustering, read here all the way through:
http://docs.splunk.com/Documentation/Splunk/7.0.3/DistSearch/SHCarchitecture

hope it helps

damode
Motivator

Hi @Adonio,
Thanks for your input. However, I am looking for a little more detailed suggestions on how Splunk deployment can be planned to support DR in some common scenarios.

0 Karma

adonio
Ultra Champion

@damode,
absolutely, just re-read your question and i think i see now what you mean.
to better assist, what is your RTO and RPO? do you plan to use a single splunk instance? distributed environment? clustered environment?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...