Deployment Architecture

How to use multiple interfaces (NICs) for data replication on slave in an indexer cluster?

fatemabwudel
Path Finder

Hi,

A little background regarding my question: I have a cluster of three indexers with 4 NICs each. I have a working stable indexer cluster with just 1 interface doing everything by default (input from forwarders, data replication and comm. with master, and other house keeping stuff).
Since I had couple of unused NICs, I wanted to dedicate them solely for replication purposes, so I connected indexers to each other with dedicated cable on dedicated interfaces.

For ex: indxr1 is connected to indxr2 on eno2 and connected to indxr3 on eno3 with dedicated ethernet cables.
Similarly indrx2 is connected with other two indexers on dedicated interfaces (eno2, eno3).
Hence I ended up with having two IP addresses on which each indexer can listen for replicated data (one from each indexer) on dedicated cable.

Therefore my question is, how can I configure two IPs to accept replication data from other two indexers?
I know about the setting: register_replication_address = in server.conf, but I think it doesn't work for more than one IP (plz correct me if I am wrong).
Also, I believe I would need to specify the replication ports for those two listening interfaces as well, so how do I specify them as well?
Again, I am aware of the setting [replication_port://] stanza in server.conf, but will it allow me to specify multiple listening ports as well?

Lastly, is it even possible to do above (using two diff. interfaces for replication on same slave)?

Any help would be appreciated.

Thanks,
Fatema.

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

View solution in original post

0 Karma

Masa
Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

0 Karma

fatemabwudel
Path Finder

Thanks Masa, for confirming on this. I will look into how to bond the two interfaces and use it, thanks for providing a reference link.

Fatema.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...