Deployment Architecture

How to use multiple interfaces (NICs) for data replication on slave in an indexer cluster?

fatemabwudel
Path Finder

Hi,

A little background regarding my question: I have a cluster of three indexers with 4 NICs each. I have a working stable indexer cluster with just 1 interface doing everything by default (input from forwarders, data replication and comm. with master, and other house keeping stuff).
Since I had couple of unused NICs, I wanted to dedicate them solely for replication purposes, so I connected indexers to each other with dedicated cable on dedicated interfaces.

For ex: indxr1 is connected to indxr2 on eno2 and connected to indxr3 on eno3 with dedicated ethernet cables.
Similarly indrx2 is connected with other two indexers on dedicated interfaces (eno2, eno3).
Hence I ended up with having two IP addresses on which each indexer can listen for replicated data (one from each indexer) on dedicated cable.

Therefore my question is, how can I configure two IPs to accept replication data from other two indexers?
I know about the setting: register_replication_address = in server.conf, but I think it doesn't work for more than one IP (plz correct me if I am wrong).
Also, I believe I would need to specify the replication ports for those two listening interfaces as well, so how do I specify them as well?
Again, I am aware of the setting [replication_port://] stanza in server.conf, but will it allow me to specify multiple listening ports as well?

Lastly, is it even possible to do above (using two diff. interfaces for replication on same slave)?

Any help would be appreciated.

Thanks,
Fatema.

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

View solution in original post

0 Karma

Masa
Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

0 Karma

fatemabwudel
Path Finder

Thanks Masa, for confirming on this. I will look into how to bond the two interfaces and use it, thanks for providing a reference link.

Fatema.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...